AZL-113687: CVE-2026-116307 affecting package postgresql 16.15-1

Q: Who can exploit this vulnerability?

An attacker needs the ability to create a relevant object in PostgreSQL and to cause re-entry into PL/Perl while a prepared query is executing. Successful exploitation can execute arbitrary code as the operating system user that runs the database.

Q: Is postgresql 16.15-1 affected?

Yes. PostgreSQL versions before 16.16 are affected, so version 16.15-1 falls within the affected range.

Q: What version should PostgreSQL 16 users upgrade to?

Upgrade to PostgreSQL 16.16 or a later fixed release. Other fixed release lines are 18.7, 17.12, 15.20, and 14.25.

Published Nov 12, 2026

Updated

Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116307

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs the ability to create a relevant object in PostgreSQL and to cause re-entry into PL/Perl while a prepared query is executing. Successful exploitation can execute arbitrary code as the operating system user that runs the database.

Is postgresql 16.15-1 affected?