CVE-2026-116319 PostgreSQL plperl reentrant return_next() use-after-free executes arbitrary code

This vulnerability is rated as having Important impact because an authenticated database user with permissions to define functions or objects can exploit a memory corruption flaw to achieve arbitrary code execution in the context of the postgres system user. While successful exploitation grants system-level access under the PostgreSQL process account, the PL/Perl procedural language extension is not enabled by default in standard Red Hat deployments. Consequently, systems that do not explicitly install and enable PL/Perl or that restrict object creation privileges to trusted administrators are not exposed to this issue.

Remove the optional PL/Perl package if it is not required by your applications:

# dnf remove postgresql-plperl

Alternatively, drop the PL/Perl extension from affected databases:

DROP EXTENSION IF EXISTS plperl CASCADE;

DROP EXTENSION IF EXISTS plperlu CASCADE;

If the extension is required, restrict execution privileges by revoking usage on the language from untrusted database roles:

REVOKE USAGE ON LANGUAGE plperl FROM PUBLIC;

Caveats: Dropping the extension or removing the package will break existing stored procedures and database applications that depend on PL/Perl. Revoking USAGE permissions prevents unprivileged users from executing PL/Perl functions.

Warning: Restarting or reloading the PostgreSQL service (e.g., `systemctl restart postgresql`) may be necessary to terminate existing database sessions and apply changes fully, which will temporarily interrupt active client connections.