CVE-2026-6479

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL (Secure Sockets Layer) and GSS (Generic Security Service) negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AF_UNIX socket. If SSL and GSS are both disabled, the same denial of service can be achieved via a PostgreSQL TCP socket.

Uncontrolled recursion during PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL socket to trigger sustained CPU/stack exhaustion, resulting in denial of service. This affects the core connection-negotiation path, which runs unconditionally for every incoming connection attempt regardless of configuration — there is no optional feature or code path that must be enabled for exploitation, unlike some other recent flaws in this batch. Fix versions are 18.4, 17.10, 16.14, 15.18, and 14.23; PostgreSQL 12 and 13 branches are not listed as affected by upstream and do not contain the vulnerable recursion path. Affects were determined purely by comparing each shipped build's PostgreSQL version against these per-major-version fix thresholds.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to PostgreSQL 18.4, 17.10, 16.14, 15.18, or 14.23 (matching your major version) or later. Restricting network/socket access to trusted clients reduces exposure but does not eliminate the vulnerability.