CVE-2026-116307: PostgreSQL plperl prepared-query use-after-free executes arbitrary code

Published Nov 12, 2026

Updated

Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which PostgreSQL deployments are affected?

Deployments running PostgreSQL with plperl and versions earlier than 18.7, 17.12, 16.16, 15.20, or 14.25 are affected. The issue involves prepared queries used through plperl.

What level of access does an attacker need?

An attacker needs privileges to create the relevant object and must be able to trigger re-entry into plperl while an outer invocation is executing a prepared query. No user interaction is required.

What is the potential impact of successful exploitation?

Successful exploitation can execute arbitrary code as the operating system user that runs the PostgreSQL database. This can affect confidentiality, integrity, and availability of the host and database environment.