CVE-2026-116323 PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code

Red Hat rates this vulnerability as Important because an authenticated user with permission to create database objects can achieve arbitrary code execution under the postgres operating system account. In standard Red Hat Enterprise Linux deployments, the PL/Tcl procedural language is neither installed nor enabled by default, significantly limiting exposure on typical systems. Risk is primarily confined to environments where the optional PL/Tcl subpackage is explicitly installed and untrusted users have been granted object creation privileges.

If PL/Tcl is not required, remove the optional procedural language package or drop the extension from affected databases. Alternatively, restrict object creation permissions for untrusted database accounts.

1. To remove the optional PL/Tcl package:

# dnf remove postgresql-pltcl

2. To remove the extension from a specific database, execute the following SQL commands as a database administrator:

DROP EXTENSION IF EXISTS pltcl CASCADE;

DROP EXTENSION IF EXISTS pltclu CASCADE;

3. To prevent untrusted accounts from creating custom domains or objects, revoke schema creation privileges:

REVOKE CREATE ON SCHEMA <schema_name> FROM <username>;

Caveats:

Dropping the extension with CASCADE removes all dependent database functions, triggers, and objects implemented in PL/Tcl, which can impair application functionality. If package removal or administrative actions require reloading or restarting the PostgreSQL service (systemctl restart postgresql), active client connections will be terminated.