---
id: "CVE-2026-116320"
page: "https://infrastack.ai/live/CVE-2026-116320"
kind: "vulnerability"
aliases: ["CVE-2026-116320"]
title: "PostgreSQL: plperl use-after-free lets an object creator run OS code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["database", "plperl", "postgresql", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "patched-version", "plperl-not-installed"]
published_at: "2026-11-12T15:17:40+00:00"
first_seen_at: "2026-11-12T15:41:54+00:00"
updated_at: "2026-11-12T15:43:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116320", "first_seen_at": "2026-11-12T15:41:54+00:00"}]
exploit_sources: []
---

# PostgreSQL: plperl use-after-free lets an object creator run OS code

Link for people: https://infrastack.ai/live/CVE-2026-116320 (this .md is for agents)

PostgreSQL's plperl extension has a use-after-free bug when it converts Perl arrays or hashes, triggered by dropping the last reference to such an object. An attacker who can create such objects can execute arbitrary code as the operating system user running the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the server version with `postgres --version` or `SELECT version();`, and compare it with the fixed releases below.
- Check whether the plperl extension is installed with `SELECT * FROM pg_extension WHERE extname = 'plperl';`.

## Fix

- PostgreSQL `18.7`
- PostgreSQL `17.12`
- PostgreSQL `16.16`
- PostgreSQL `15.20`
- PostgreSQL `14.25`

## Timeline

- 2026-11-12T15:41:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116320

## From the sources

Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_