CVE-2026-116309 PostgreSQL plperl blessed-reference type confusion may execute arbitrary code

This vulnerability is rated as an Important severity because an authenticated database user with permissions to create functions can trigger code execution in the context of the PostgreSQL server process. In standard Red Hat deployments, the PL/Perl procedural language extension is not enabled by default and requires manual installation of the optional postgresql-plperl package. Databases where PL/Perl is not enabled or where untrusted users are not granted function creation privileges are not exposed to this flaw.

If PL/Perl is not required, remove the extension from affected databases or uninstall the optional package. Alternatively, restrict language access so that unprivileged users cannot create PL/Perl functions.

To remove the PL/Perl extension from a database:

```sql

DROP EXTENSION IF EXISTS plperl CASCADE;

```

To revoke access to the language from general users while retaining it for administrators:

```sql

REVOKE USAGE ON LANGUAGE plperl FROM PUBLIC;

```

To remove the PL/Perl package from the operating system:

```bash

dnf remove postgresql-plperl

```

Caveats: Dropping the extension or uninstalling the package will prevent any existing PL/Perl functions from executing, which may disrupt applications that depend on them. Modifying database extensions takes effect immediately for connected sessions and does not require a service restart.