AZL-113693: CVE-2026-116309 affecting package postgresql 16.15-1

Q: Who can potentially exploit this issue?

An attacker would need the ability to create an object and invoke PostgreSQL plperl behavior involving blessing a non-hash reference into PostgreSQL::InServer::ARRAY. The issue is relevant where untrusted or insufficiently trusted users can perform those actions.

Q: Which PostgreSQL releases need to be updated?

Affected releases are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed azure-linux/postgresql package version 16.15-1 is below the fixed PostgreSQL 16.16 release.

Q: How certain is the security impact?

The reported condition may allow arbitrary code execution, but it has not been confirmed whether an attacker can control the pointer sufficiently to achieve security impact. It should nevertheless be handled as potentially exploitable.

Published Nov 12, 2026

Updated

Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116309

Frequently Asked Questions

Who can potentially exploit this issue?

An attacker would need the ability to create an object and invoke PostgreSQL plperl behavior involving blessing a non-hash reference into PostgreSQL::InServer::ARRAY. The issue is relevant where untrusted or insufficiently trusted users can perform those actions.

Which PostgreSQL releases need to be updated?

Affected releases are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed azure-linux/postgresql package version 16.15-1 is below the fixed PostgreSQL 16.16 release.

How certain is the security impact?

The reported condition may allow arbitrary code execution, but it has not been confirmed whether an attacker can control the pointer sufficiently to achieve security impact. It should nevertheless be handled as potentially exploitable.

AZL-113693: CVE-2026-116309 affecting package postgresql 16.15-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can potentially exploit this issue?

Which PostgreSQL releases need to be updated?

How certain is the security impact?

Company

Resources

Contact

Frequently Asked Questions

Who can potentially exploit this issue?

Which PostgreSQL releases need to be updated?

How certain is the security impact?