{"id":"CVE-2026-116320","kind":"vulnerability","aliases":["CVE-2026-116320"],"related":[],"title":"PostgreSQL: plperl use-after-free lets an object creator run OS code","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL's plperl extension has a use-after-free bug when it converts Perl arrays or hashes, triggered by dropping the last reference to such an object. An attacker who can create such objects can execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","plperl","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting","patched-version","plperl-not-installed"],"how_to_check":"- Check the server version with `postgres --version` or `SELECT version();`, and compare it with the fixed releases below.\n- Check whether the plperl extension is installed with `SELECT * FROM pg_extension WHERE extname = 'plperl';`.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","triaged_at":"2026-11-12T15:43:30+00:00","updated_at":"2026-11-12T15:43:30+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T15:43:30Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"local","title":"PostgreSQL: plperl use-after-free lets an object creator run OS code","impact":"high","summary":"PostgreSQL's plperl extension has a use-after-free bug when it converts Perl arrays or hashes, triggered by dropping the last reference to such an object. An attacker who can create such objects can execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","plperl","self-hosted","database"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as the database operating system user on the server.","analyst_note":"","how_to_check":"- Check the server version with `postgres --version` or `SELECT version();`, and compare it with the fixed releases below.\n- Check whether the plperl extension is installed with `SELECT * FROM pg_extension WHERE extname = 'plperl';`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plperl-not-installed","patched-version","managed-hosting"],"who_is_affected":"Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, or 14.25 are affected. The flaw is in plperl, so the risk is mainly for deployments that use the plperl language; the sources do not say whether it is exploitable without it. The attacker must be able to create Perl objects inside the database, so a restricted role with no create rights is less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00077,"input_tokens":4565,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116320':16A,19A '-2026':15A,18A '14.25':121C '15.20':119C '16.16':118C '17.12':117C '18.7':116C 'affect':123C 'allow':80C 'arbitrari':64B,86C 'array':42B,104C 'attack':56B 'bug':37B 'code':13A,65B,87C 'convert':40B,110C 'creat':59B 'creator':10A,83C 'cve':14A,17A 'databas':20B,73B,95C 'drop':47B,97C 'execut':63B,85C 'extens':30B 'final':99C 'free':6A,36B,76C 'hash':44B,106C 'host':26B 'last':49B 'let':7A 'object':9A,54B,61B,82C,112C 'oper':68B,90C 'os':12A 'perl':41B,103C 'plperl':2A,21B,29B,79C 'postgresql':1A,22B,27B,78C,108C,115C 'refer':50B,100C 'run':11A,71B,93C 'runtim':23B 'self':25B 'self-host':24B 'system':69B,91C 'trigger':45B 'use':4A,34B,74C 'use-after-fre':3A,33B 'user':70B,92C 'version':113C 'via':96C","nicknames":[],"mitigations":[],"who_affected":"Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, or 14.25 are affected. The flaw is in plperl, so the risk is mainly for deployments that use the plperl language; the sources do not say whether it is exploitable without it. The attacker must be able to create Perl objects inside the database, so a restricted role with no create rights is less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","plperl","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116320':16A,19A '-2026':15A,18A 'code':13A 'creator':10A 'cve':14A,17A 'free':6A 'let':7A 'object':9A 'os':12A 'plperl':2A 'postgresql':1A 'run':11A 'use':4A 'use-after-fre':3A","search_b":"'arbitrari':64B 'array':42B 'attack':56B 'bug':37B 'code':65B 'convert':40B 'creat':59B 'databas':20B,73B 'drop':47B 'execut':63B 'extens':30B 'free':36B 'hash':44B 'host':26B 'last':49B 'object':54B,61B 'oper':68B 'perl':41B 'plperl':21B,29B 'postgresql':22B,27B 'refer':50B 'run':71B 'runtim':23B 'self':25B 'self-host':24B 'system':69B 'trigger':45B 'use':34B 'use-after-fre':33B 'user':70B","search_c":"'14.25':121C '15.20':119C '16.16':118C '17.12':117C '18.7':116C 'affect':123C 'allow':80C 'arbitrari':86C 'array':104C 'code':87C 'convert':110C 'creator':83C 'databas':95C 'drop':97C 'execut':85C 'final':99C 'free':76C 'hash':106C 'object':82C,112C 'oper':90C 'perl':103C 'plperl':79C 'postgresql':78C,108C,115C 'refer':100C 'run':93C 'system':91C 'use':74C 'user':92C 'version':113C 'via':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116320","severity":null,"published_at":"2026-11-12T15:17:40+00:00","modified_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","fetched_at":"2026-11-12T15:41:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}