CVE-2026-6479
Description
A flaw was found in PostgreSQL. Uncontrolled recursion during SSL (Secure Sockets Layer) and GSS (Generic Security Service) negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AF_UNIX socket. If SSL and GSS are both disabled, the same denial of service can be achieved via a PostgreSQL TCP socket.
Statement
Uncontrolled recursion during PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL socket to trigger sustained CPU/stack exhaustion, resulting in denial of service. This affects the core connection-negotiation path, which runs unconditionally for every incoming connection attempt regardless of configuration — there is no optional feature or code path that must be enabled for exploitation, unlike some other recent flaws in this batch. Fix versions are 18.4, 17.10, 16.14, 15.18, and 14.23; PostgreSQL 12 and 13 branches are not listed as affected by upstream and do not contain the vulnerable recursion path. Affects were determined purely by comparing each shipped build's PostgreSQL version against these per-major-version fix thresholds.
Mitigation
Upgrade to PostgreSQL 18.4, 17.10, 16.14, 15.18, or 14.23 (matching your major version) or later. Restricting network/socket access to trusted clients reduces exposure but does not eliminate the vulnerability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
