{"id":"CVE-2026-116326","kind":"vulnerability","aliases":["CVE-2026-116326"],"related":[],"title":"PostgreSQL: plperl exception handling lets a Perl object run code","description":"Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error.  We have not ruled out arbitrary code execution on some platform.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL's plperl extension mishandles uncaught exceptions raised by tied or overloaded Perl objects, which can leave a stale jump buffer in use. The sources say arbitrary code execution on some platforms has not been ruled out.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","plperl","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting","plperl-not-installed"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Check whether the `plperl` or `plperlu` extension is installed with `SELECT * FROM pg_extension WHERE extname LIKE 'plperl%';`","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","triaged_at":"2026-11-12T15:43:29+00:00","updated_at":"2026-11-12T15:43:29+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:29Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"local","title":"PostgreSQL: plperl exception handling lets a Perl object run code","impact":"high","summary":"PostgreSQL's plperl extension mishandles uncaught exceptions raised by tied or overloaded Perl objects, which can leave a stale jump buffer in use. The sources say arbitrary code execution on some platforms has not been ruled out.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","plperl","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"code may run on the database server on some platforms","analyst_note":"Confirm from the PostgreSQL security advisory whether arbitrary code execution is confirmed on any platform and whether the fixed versions match the NVD ranges.","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Check whether the `plperl` or `plperlu` extension is installed with `SELECT * FROM pg_extension WHERE extname LIKE 'plperl%';`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plperl-not-installed","managed-hosting"],"who_is_affected":"Only PostgreSQL servers with the plperl or plperlu extension installed are exposed, since the flaw is in that Perl procedural language handler. The sources describe the trigger as an object creator, so the people who can create Perl objects inside the database are the ones who can reach it. Servers without plperl installed can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4608,"output_tokens":643,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116326':13A,16A '-2026':12A,15A '14.25':115C '15.20':113C '16.16':112C '17.12':111C '18.7':110C 'affect':117C 'allow':65C 'anoth':94C 'arbitrari':50B,101C 'buf':76C 'buffer':44B 'caus':70C 'code':10A,51B,102C 'convers':88C 'creator':68C 'cve':11A,14A 'databas':17B 'error':95C 'except':3A,30B,61C 'execut':52B,103C 'extens':27B 'handl':4A,93C 'host':23B 'jump':43B 'leav':40B 'let':5A 'mishandl':28B 'object':8A,37B,67C,81C,85C 'overload':35B,87C 'perl':7A,36B,80C,84C 'platform':55B,106C 'plperl':2A,18B,26B,64C,91C 'postgresql':1A,19B,24B,63C,109C 'rais':31B 'rule':59B,99C 'run':9A 'runtim':20B 'say':49B 'self':22B 'self-host':21B 'sigjmp':75C 'sourc':48B 'stale':42B,74C 'throw':89C 'tie':33B,79C 'uncaught':29B,60C 'use':46B,71C 'version':107C 'via':77C 'whose':86C","nicknames":[],"mitigations":[],"who_affected":"Only PostgreSQL servers with the plperl or plperlu extension installed are exposed, since the flaw is in that Perl procedural language handler. The sources describe the trigger as an object creator, so the people who can create Perl objects inside the database are the ones who can reach it. Servers without plperl installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","plperl","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116326':13A,16A '-2026':12A,15A 'code':10A 'cve':11A,14A 'except':3A 'handl':4A 'let':5A 'object':8A 'perl':7A 'plperl':2A 'postgresql':1A 'run':9A","search_b":"'arbitrari':50B 'buffer':44B 'code':51B 'databas':17B 'except':30B 'execut':52B 'extens':27B 'host':23B 'jump':43B 'leav':40B 'mishandl':28B 'object':37B 'overload':35B 'perl':36B 'platform':55B 'plperl':18B,26B 'postgresql':19B,24B 'rais':31B 'rule':59B 'runtim':20B 'say':49B 'self':22B 'self-host':21B 'sourc':48B 'stale':42B 'tie':33B 'uncaught':29B 'use':46B","search_c":"'14.25':115C '15.20':113C '16.16':112C '17.12':111C '18.7':110C 'affect':117C 'allow':65C 'anoth':94C 'arbitrari':101C 'buf':76C 'caus':70C 'code':102C 'convers':88C 'creator':68C 'error':95C 'except':61C 'execut':103C 'handl':93C 'object':67C,81C,85C 'overload':87C 'perl':80C,84C 'platform':106C 'plperl':64C,91C 'postgresql':63C,109C 'rule':99C 'sigjmp':75C 'stale':74C 'throw':89C 'tie':79C 'uncaught':60C 'use':71C 'version':107C 'via':77C 'whose':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116326","severity":null,"published_at":"2026-11-12T15:17:41+00:00","modified_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","fetched_at":"2026-11-12T15:41:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}