CVE-2026-6479: PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion
Last updated 22 May 2026
Other sources
PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion
— Microsoft
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AFUNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/postgresql-15to a version that resolves this vulnerability.Fixed in 15.18-0+deb12u1 - Upgrade
Upgrade
debian/postgresql-17to a version that resolves this vulnerability.Fixed in 17.10-0+deb13u1 - Upgrade
Upgrade
debian/postgresql-18to a version that resolves this vulnerability.Fixed in 18.4-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.23 - Compensating control
Prevent untrusted access to PostgreSQL AF_UNIX sockets (and TCP sockets as applicable) to reduce exposure to the uncontrolled recursion DoS when SSL and GSS are both disabled.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6479?
CVE-2026-6479 has a severity rating that indicates a potential denial of service risk in affected PostgreSQL versions.
How do I fix CVE-2026-6479?
To fix CVE-2026-6479, upgrade to PostgreSQL version 18.4 or later, or apply the necessary patches provided by the PostgreSQL project.
What versions of PostgreSQL are affected by CVE-2026-6479?
CVE-2026-6479 affects PostgreSQL versions up to and including 18.3, 17.9, 16.13, 15.17, and 14.22.
How does CVE-2026-6479 lead to denial of service?
CVE-2026-6479 allows uncontrolled recursion during SSL and GSS negotiation, which can overwhelm the PostgreSQL server and cause it to become unresponsive.
Can CVE-2026-6479 be exploited without SSL and GSS enabled?
Yes, CVE-2026-6479 can still be exploited even if SSL and GSS are disabled, as an attacker can connect via a PostgreSQL AF_UNIX socket.