AZL-113726: CVE-2026-116326 affecting package postgresql 16.15-1
Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmpbuf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error. We have not ruled out arbitrary code execution on some platform. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which PostgreSQL releases contain the fix?
The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Earlier releases in those major-version branches are affected.
What conditions are required to trigger the issue?
An attacker needs to be able to create a Perl object used by plperl, specifically a tied object or an object whose overloaded conversion can throw an exception while plperl is handling another error. The provided information does not establish whether default PostgreSQL configurations expose plperl or permit untrusted users to meet these conditions.
How serious could successful exploitation be?
The stale sigjmp_buf use can be caused through uncaught exceptions in plperl. Arbitrary code execution has not been ruled out on some platforms, but it is not confirmed by the available information.