AZL-113717: CVE-2026-116320 affecting package postgresql 16.15-1
Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be able to create a Perl array or hash object handled by PostgreSQL plperl and cause its final reference to be dropped while PostgreSQL converts the object.
What is the impact if exploitation succeeds?
Successful exploitation can execute arbitrary code as the operating system user that runs the database server.
How can I determine whether my PostgreSQL version is affected?
Affected versions are PostgreSQL releases before 18.7, 17.12, 16.16, 15.20, and 14.25. The listed postgresql 16.15-1 package is below the 16.16 fixed release threshold.