CVE-2026-116326

Public on 2026-11-12
Modified on 2026-11-14
Description
Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error. We have not ruled out arbitrary code execution on some platform. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
8.8
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Postgresql14 Extra libpq Not Affected
Amazon Linux 2023 libpq Not Affected
Amazon Linux 2027 Preview libpq Not Affected
Amazon Linux 2 - Core postgresql Pending Fix
Amazon Linux 2 - Postgresql14 Extra postgresql Pending Fix
Amazon Linux 2023 postgresql15 Pending Fix
Amazon Linux 2023 postgresql16 Pending Fix
Amazon Linux 2027 Preview postgresql16 Pending Fix
Amazon Linux 2023 postgresql17 Pending Fix
Amazon Linux 2027 Preview postgresql17 Pending Fix
Amazon Linux 2023 postgresql18 Pending Fix
Amazon Linux 2027 Preview postgresql18 Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H