CVE-2026-116326: PostgreSQL plperl tied-object exceptions follow stale sigjmp_buf
Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmpbuf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error. We have not ruled out arbitrary code execution on some platform. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Event History
Frequently Asked Questions
Which PostgreSQL releases include the fix?
Upgrade to PostgreSQL 18.7, 17.12, 16.16, 15.20, or 14.25, or a later release in the corresponding supported branch. Earlier versions are affected.
What level of access does an attacker need?
The vulnerability is rated as requiring low privileges. The described attack involves an object creator using a tied Perl object or an object with an overloaded conversion that throws while plperl handles another error.
Is arbitrary code execution confirmed?
Arbitrary code execution has not been ruled out on some platforms, but it is not confirmed by the available information.