AZL-113714: CVE-2026-116319 affecting package postgresql 16.15-1
Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant returnnext() calls. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16
Event History
Frequently Asked Questions
Who can exploit this issue?
An object creator who can use PL/Perl and trigger reentrant return_next() calls can exploit the vulnerability. Successful exploitation allows arbitrary code execution as the operating system user running the database.
Which PostgreSQL releases are affected?
Affected releases are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed package version is postgresql 16.15-1, which is below the fixed 16.16 release.