CVE-2026-116326 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL's plperl extension mishandles uncaught exceptions raised by tied or overloaded Perl objects, which can leave a stale jump buffer in use. The sources say arbitrary code execution on some platforms has not been ruled out.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only PostgreSQL servers with the plperl or plperlu extension installed are exposed, since the flaw is in that Perl procedural language handler. The sources describe the trigger as an object creator, so the people who can create Perl objects inside the database are the ones who can reach it. Servers without plperl installed can skip it.
Not affected if managed-hosting, plperl-not-installed
Who cares database, plperl, postgresql, self-hosted
SELECT version(); in psql and compare against the fixed versions below.plperl or plperlu extension is installed with SELECT * FROM pg_extension WHERE extname LIKE 'plperl%';18.717.1216.16Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error. We have not ruled out arbitrary code execution on some platform. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
15.2014.25