CVE-2026-116309

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116309", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-26T03:52:44.052Z", "datePublished": "2026-11-12T14:15:05.119Z", "dateUpdated": "2026-11-13T05:03:03.964Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-12T14:15:05.119Z"}, "title": "PostgreSQL plperl blessed-reference type confusion may execute arbitrary code", "x_postgresql": {"component": "core server"}, "descriptions": [{"lang": "en", "value": "Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-843", "type": "CWE", "description": "Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-116309/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "Attacker has permission to \"CREATE EXTENSION plperl\", or another user previously issued that. Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Zheng Yu for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-116309"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-13T05:03:03.964Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}], "id": "CVE-2026-116309", "lastModified": "2026-11-13T05:18:04.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116309", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-11-12T15:17:38.647", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.postgresql.org/support/security/CVE-2026-116309/"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql: postgresql: Arbitrary code execution via type confusion in PL/Perl", "id": "2572550", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572550"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-843", "details": ["A flaw was found in PostgreSQL. A type confusion vulnerability in the PL/Perl (Procedural Language/Perl) extension may allow an authenticated database user to achieve arbitrary code execution. By passing an unexpected data reference type into an internal array structure (PostgreSQL::InServer::ARRAY), an attacker can cause the server to misinterpret memory, potentially compromising the underlying database host."], "mitigation": {"lang": "en:us", "value": "If PL/Perl is not required, remove the extension from affected databases or uninstall the optional package. Alternatively, restrict language access so that unprivileged users cannot create PL/Perl functions.\nTo remove the PL/Perl extension from a database:\n```sql\nDROP EXTENSION IF EXISTS plperl CASCADE;\n```\nTo revoke access to the language from general users while retaining it for administrators:\n```sql\nREVOKE USAGE ON LANGUAGE plperl FROM PUBLIC;\n```\nTo remove the PL/Perl package from the operating system:\n```bash\ndnf remove postgresql-plperl\n```\nCaveats: Dropping the extension or uninstalling the package will prevent any existing PL/Perl functions from executing, which may disrupt applications that depend on them. Modifying database extensions takes effect immediately for connected sessions and does not require a service restart."}, "name": "CVE-2026-116309", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libpq", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql17", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql18", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-12T14:15:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116309\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116309\nhttps://www.postgresql.org/support/security/CVE-2026-116309/"], "statement": "This vulnerability is rated as an Important severity because an authenticated database user with permissions to create functions can trigger code execution in the context of the PostgreSQL server process. In standard Red Hat deployments, the PL/Perl procedural language extension is not enabled by default and requires manual installation of the optional postgresql-plperl package. Databases where PL/Perl is not enabled or where untrusted users are not granted function creation privileges are not exposed to this flaw.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18,18.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17,17.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16,16.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15,15.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,14.25)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PostgreSQL", "source": "cna", "vendor": "n/a"}, "product": "postgresql", "vendor": "postgresql"}], "created": "2026-11-13T01:15:12.333903+00:00", "updated": "2026-11-13T06:15:16.184864+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$postgresql"]}