CVE-2026-116309: PostgreSQL plperl blessed-reference type confusion may execute arbitrary code
Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker needs the ability to create an object in plperl. The vulnerability is associated with blessing a non-hash reference into PostgreSQL::InServer::ARRAY.
Which PostgreSQL releases need remediation?
Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. Upgrade to the applicable listed release or later.
Is arbitrary code execution confirmed?
The issue may allow arbitrary code execution, but it has not been confirmed or ruled out whether an attacker can control the pointer sufficiently to achieve security impact. It is being treated as potentially exploitable.