CVE-2026-6479: PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion
Last updated 22 May 2026
Other sources
PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion
— Microsoft
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AFUNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6479?
CVE-2026-6479 has a severity rating that indicates a potential denial of service risk in affected PostgreSQL versions.
How do I fix CVE-2026-6479?
To fix CVE-2026-6479, upgrade to PostgreSQL version 18.4 or later, or apply the necessary patches provided by the PostgreSQL project.
What versions of PostgreSQL are affected by CVE-2026-6479?
CVE-2026-6479 affects PostgreSQL versions up to and including 18.3, 17.9, 16.13, 15.17, and 14.22.
How does CVE-2026-6479 lead to denial of service?
CVE-2026-6479 allows uncontrolled recursion during SSL and GSS negotiation, which can overwhelm the PostgreSQL server and cause it to become unresponsive.
Can CVE-2026-6479 be exploited without SSL and GSS enabled?
Yes, CVE-2026-6479 can still be exploited even if SSL and GSS are disabled, as an attacker can connect via a PostgreSQL AF_UNIX socket.