CVE-2026-6479
Description
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Uncontrolled recursion in PostgreSQL SSL/GSS negotiation allows denial of service via specially crafted connection attempts.
Vulnerability
Description CVE-2026-6479 is an uncontrolled recursion vulnerability in PostgreSQL's SSL and GSS negotiation handling. When a client initiates a connection, the server processes negotiation parameters without proper depth checking, leading to infinite recursion and stack exhaustion. This bug affects all PostgreSQL versions before 18.4, 17.10, 16.14, 15.18, and 14.23 [1].
Exploitation
Details An attacker can trigger the vulnerability by connecting to a PostgreSQL AF_UNIX socket if SSL or GSS is enabled. If both SSL and GSS are disabled, the same effect can be achieved via a TCP socket. No authentication is required, and the attack can be performed with network access to the socket [1]. The uncontrolled recursion causes the server to consume excessive stack memory, eventually crashing or becoming unresponsive.
Impact
Successful exploitation results in a sustained denial of service, disrupting database availability. Since the attack does not require credentials and can be launched repeatedly, it can keep the server offline indefinitely. The CVSS v3 base score is 7.5 (High), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low complexity, no privileges required, and high availability impact [1].
Mitigation
The PostgreSQL project has released fixed versions (18.4, 17.10, 16.14, 15.18, 14.23) as of 2026-05-14. Users should upgrade to these versions immediately. If upgrade is not possible, disabling SSL and GSS and restricting TCP socket access may reduce risk, but the only complete fix is patching [1].
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: before 18.4, 17.10, 16.14, 15.18, 14.23
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- www.postgresql.org/support/security/CVE-2026-6479/nvdPatchVendor Advisory
News mentions
0No linked articles in our index yet.