PostgreSQL: plperl extension type confusion (CVE-2026-116309)
A type confusion vulnerability in the PostgreSQL plperl extension involves blessing a non-hash reference into PostgreSQL::InServer::ARRAY.
CVE search metadata
CVE search record: CVE-2026-116309. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL. Brief: PostgreSQL: plperl extension type confusion (CVE-2026-116309). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-plperl-type-confusion-cve-2026-116309/
Triage facts
Revision 1- Applicability
- PostgreSQL
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A type confusion vulnerability exists in the PostgreSQL plperl extension. An attacker can trigger this flaw by blessing a non-hash reference into the PostgreSQL::InServer::ARRAY class. It has not been confirmed or ruled out whether an attacker can control the pointer sufficiently to achieve security impact, but researchers are proceeding as though that is possible.
Impact
The vulnerability has a CVSS v3.1 base score of 8.8.