CVE-2026-6479 Details
Description
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
A denial-of-service vulnerability has been identified in PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23. The issue arises from uncontrolled recursion during SSL and GSS negotiation, which can be exploited by an attacker with access to a PostgreSQL AF_UNIX socket, leading to sustained denial-of-service conditions. If both SSL and GSS are disabled, the vulnerability can be exploited through a PostgreSQL TCP socket.
Users can upgrade to PostgreSQL versions 18.4, 17.10, 16.14, 15.18, or 14.23 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.postgresql.org/support/security/CVE-2026-6479/ | PostgreSQL | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | PostgreSQL |
Affected Products
| Product | Versions |
|---|---|
| postgresql postgresql | < 14.23 >= 15.0, < 15.18 >= 16.0, < 16.14 >= 17.0, < 17.10 >= 18.0, < 18.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | PostgreSQL |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | New CVE Received | PostgreSQL |