CVE-2026-116307 PostgreSQL plperl prepared-query use-after-free executes arbitrary code

Red Hat Product Security rates this vulnerability as Important because authenticated accounts permitted to define custom database objects can execute shell commands under the PostgreSQL service account. The impact does not reach Critical severity because exploitation requires existing database access along with specific object creation permissions, and the PL/Perl language extension is not enabled in standard deployments by default. Environments remain unaffected unless administrators explicitly install and activate PL/Perl and grant object-definition rights to untrusted users.

To mitigate this vulnerability, disable the PL/Perl procedural language extension or remove its subpackage if PL/Perl functions are not required:

1. Drop the PL/Perl extension from affected databases:

```sql

DROP EXTENSION IF EXISTS plperl CASCADE;

DROP EXTENSION IF EXISTS plperlu CASCADE;

```

2. Alternatively, revoke language usage privileges from untrusted roles:

```sql

REVOKE USAGE ON LANGUAGE plperl FROM PUBLIC;

```

3. If PL/Perl is entirely unused across the host, uninstall the optional subpackage:

```sh

# dnf remove postgresql-plperl

```

Caveats:

- Dropping the extension or removing the subpackage will cause any database queries or stored procedures relying on PL/Perl to fail.

- Using CASCADE will recursively drop all database objects (such as functions and triggers) that depend on PL/Perl.

- Warning: Modifying system packages or stopping the database service for maintenance may require a service reload or restart (`systemctl restart postgresql`), which will disconnect active client sessions and cause temporary database unavailability.