← Back to CVE List
CVE-2026-6479NVD
Vulnerability Summary
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVSS v3.1 Base Metrics — Score 7.5 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Affected & Patched Versions
- Postgresql Postgresql < 14.23
- Postgresql Postgresql >= 15.0 and < 15.18
- Postgresql Postgresql >= 16.0 and < 16.14
- Postgresql Postgresql >= 17.0 and < 17.10
- Postgresql Postgresql >= 18.0 and < 18.4
- Postgresql Postgresql 14.23
- Postgresql Postgresql 15.18
- Postgresql Postgresql 16.14
- Postgresql Postgresql 17.10
- Postgresql Postgresql 18.4