Executive brief
PostgreSQL is a widely used database system for storing and managing business data. A vulnerability in how the database handles initial connection requests can allow an attacker to crash the service, leading to a sustained outage. This disruption can prevent applications from accessing their data, impacting business operations and service availability.
Technical details
A vulnerability classified as uncontrolled recursion (CWE-674) exists in the PostgreSQL core server during SSL and GSS negotiation. An attacker capable of connecting to a PostgreSQL AF_UNIX socket can trigger this recursion to cause a sustained denial of service. If both SSL and GSS are disabled, the same attack can be executed over a standard TCP socket. The issue is present in the connection initialization phase and does not require authentication. Patches have been released in versions 18.4, 17.10, 16.14, 15.18, and 14.23.
Affected products
- PostgreSQL PostgreSQL < 18.4, < 17.10, < 16.14, < 15.18, < 14.23
Timeline
- 2026-05-12: patched: Fixes released in multiple major versions.
- 2026-05-14: disclosed: Public disclosure of CVE-2026-6479.