CVE-2026-116309
Description
A flaw was found in PostgreSQL. A type confusion vulnerability in the PL/Perl (Procedural Language/Perl) extension may allow an authenticated database user to achieve arbitrary code execution. By passing an unexpected data reference type into an internal array structure (PostgreSQL::InServer::ARRAY), an attacker can cause the server to misinterpret memory, potentially compromising the underlying database host.
Statement
This vulnerability is rated as an Important severity because an authenticated database user with permissions to create functions can trigger code execution in the context of the PostgreSQL server process. In standard Red Hat deployments, the PL/Perl procedural language extension is not enabled by default and requires manual installation of the optional postgresql-plperl package. Databases where PL/Perl is not enabled or where untrusted users are not granted function creation privileges are not exposed to this flaw.
Mitigation
If PL/Perl is not required, remove the extension from affected databases or uninstall the optional package. Alternatively, restrict language access so that unprivileged users cannot create PL/Perl functions.
To remove the PL/Perl extension from a database:
sql
DROP EXTENSION IF EXISTS plperl CASCADE;
To revoke access to the language from general users while retaining it for administrators:
sql
REVOKE USAGE ON LANGUAGE plperl FROM PUBLIC;
To remove the PL/Perl package from the operating system:
bash
dnf remove postgresql-plperl
Caveats: Dropping the extension or uninstalling the package will prevent any existing PL/Perl functions from executing, which may disrupt applications that depend on them. Modifying database extensions takes effect immediately for connected sessions and does not require a service restart.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties.
Availability,Integrity,Confidentiality
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart
If a memory buffer is accessed using an incompatible type, and the allocated buffer is smaller than the type that the code is attempting to access, then an attacker could read or write memory outside the bounds of the buffer, leading to a crash or possibly code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
