Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql17Upgrade postgresql15Upgrade postgresql18Upgrade postgresql16 | May 15, 2026 | May 14, 2026 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-llvmjitUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-upgrade-devel | Jun 9, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade postgresql16-upgrade-develUpgrade postgresql17-contrib-debuginfoUpgrade postgresql17-test-rpm-macrosUpgrade postgresql18-contribUpgrade postgresql15-debuginfoUpgrade postgresql16-private-libs-debuginfoUpgrade postgresql17-server-develUpgrade postgresql16-plpython3Upgrade postgresql17Upgrade postgresql15-upgrade-debuginfoUpgrade postgresql18-upgrade-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql17-serverUpgrade postgresql16-server-devel-debuginfoUpgrade postgresql18-plpython3-debuginfoUpgrade postgresql18-plperlUpgrade postgresql17-staticUpgrade postgresql17-docsUpgrade postgresql17-upgradeUpgrade postgresql15-private-develUpgrade postgresql18-pltclUpgrade postgresql15-upgrade-develUpgrade postgresql17-debugsourceUpgrade postgresql18-server-devel-debuginfoUpgrade postgresql17-private-develUpgrade postgresql18-upgrade-develUpgrade postgresql18-server-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql16-server-debuginfoUpgrade postgresql15-plperlUpgrade postgresql18Upgrade postgresql16-contrib-debuginfoUpgrade postgresql16-debuginfoUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql17-upgrade-debuginfoUpgrade postgresql17-upgrade-devel-debuginfoUpgrade postgresql16-test-debuginfoUpgrade postgresql17-debuginfoUpgrade postgresql16-plpython3-debuginfoUpgrade postgresql18-upgradeUpgrade postgresql18-debugsourceUpgrade postgresql18-plperl-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql15-staticUpgrade postgresql15-llvmjitUpgrade postgresql17-private-libs-debuginfoUpgrade postgresql18-private-libsUpgrade postgresql18-contrib-debuginfoUpgrade postgresql17-testUpgrade postgresql18-serverUpgrade postgresql15-private-libsUpgrade postgresql16-docsUpgrade postgresql16-plperl-debuginfoUpgrade postgresql17-plpython3Upgrade postgresql16-server-develUpgrade postgresql17-pltcl-debuginfoUpgrade postgresql16-test-rpm-macrosUpgrade postgresql16-contribUpgrade postgresql16-serverUpgrade postgresql15Upgrade postgresql18-docsUpgrade postgresql15-plperl-debuginfoUpgrade postgresql18-test-debuginfoUpgrade postgresql15-pltclUpgrade postgresql16-testUpgrade postgresql18-docs-debuginfoUpgrade postgresql15-serverUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-docsUpgrade postgresql18-private-libs-debuginfoUpgrade postgresql18-plpython3Upgrade postgresql17-llvmjitUpgrade postgresql16-plperlUpgrade postgresql17-server-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql18-debuginfoUpgrade postgresql17-private-libsUpgrade postgresql17-plpython3-debuginfoUpgrade postgresql16-upgrade-debuginfoUpgrade postgresql16-upgradeUpgrade postgresql16-private-develUpgrade postgresql16Upgrade postgresql15-server-develUpgrade postgresql15-plpython3Upgrade postgresql18-pltcl-debuginfoUpgrade postgresql16-staticUpgrade postgresql16-private-libsUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql18-upgrade-devel-debuginfoUpgrade postgresql16-llvmjitUpgrade postgresql18-private-develUpgrade postgresql18-llvmjit-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-contribUpgrade postgresql18-server-develUpgrade postgresql17-test-debuginfoUpgrade postgresql17-server-devel-debuginfoUpgrade postgresql16-debugsourceUpgrade postgresql18-testUpgrade postgresql18-llvmjitUpgrade postgresql17-plperlUpgrade postgresql17-docs-debuginfoUpgrade postgresql17-contribUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-testUpgrade postgresql16-docs-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql18-staticUpgrade postgresql17-upgrade-develUpgrade postgresql17-pltclUpgrade postgresql17-plperl-debuginfoUpgrade postgresql16-pltclUpgrade postgresql18-test-rpm-macrosUpgrade postgresql17-llvmjit-debuginfoUpgrade postgresql16-pltcl-debuginfoUpgrade postgresql16-llvmjit-debuginfoUpgrade postgresql16-upgrade-devel-debuginfo | Jun 9, 2026 | May 14, 2026 |
| Debian | — | Upgrade postgresql-13Upgrade postgresql-15Upgrade postgresql-17 | May 17, 2026 | May 17, 2026 |
| Freebsd | — | Upgrade postgresql15-serverUpgrade postgresql17-clientUpgrade postgresql16-serverUpgrade postgresql18-serverUpgrade postgresql14-clientUpgrade postgresql17-serverUpgrade postgresql16-clientUpgrade postgresql15-clientUpgrade postgresql18-clientUpgrade postgresql14-server | May 21, 2026 | May 14, 2026 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 17, 2026 | Aug 17, 2026 |
| Postgres | — | Upgrade to PostgreSQL version 15.18Upgrade to PostgreSQL version 17.10Upgrade to PostgreSQL version 18.4Upgrade to PostgreSQL version 16.14Upgrade to PostgreSQL version 14.23 | May 14, 2026 | May 14, 2026 |
| Redhat_linux | — | Upgrade postgresql18-plpython3Upgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-test-debuginfoUpgrade postgresql18-debuginfoUpgrade postgresql18-private-libs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql18-test-debuginfoUpgrade postgresql-plpython3Upgrade postgresql18-plperlUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql18-pltcl-debuginfoUpgrade postgresql18-upgrade-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql18-server-develUpgrade postgresql18-staticUpgrade postgresql16-debugsourceUpgrade postgresql-private-libsUpgrade postgis-upgradeUpgrade postgresql18-private-develUpgrade postgis-docsUpgrade postgresql-debugsourceUpgrade postgresql18-testUpgrade postgresql18-test-rpm-macrosUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade postgresql18-contrib-debuginfoUpgrade postgresql18-upgrade-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-private-develUpgrade postgis-debugsourceUpgrade postgresql-docsUpgrade pg_repackUpgrade postgres-decoderbufs-debuginfoUpgrade postgis-client-debuginfoUpgrade postgresql18-server-devel-debuginfoUpgrade postgresql18-docs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql18-private-libsUpgrade postgresql18-docsUpgrade postgresql18Upgrade postgresql18-plpython3-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-devel-debuginfoUpgrade postgresql18-plperl-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql18-debugsourceUpgrade postgis-clientUpgrade postgisUpgrade postgis-utilsUpgrade pg_repack-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade postgresql18-serverUpgrade postgresql-server-develUpgrade postgresql-plperl-debuginfoUpgrade pgvector-debugsourceUpgrade pgvector-debuginfoUpgrade postgresql-contribUpgrade postgis-debuginfoUpgrade postgresql-upgrade-develUpgrade pg_repack-debugsourceNo solution existsUpgrade postgresql18-upgradeUpgrade postgresql18-contribUpgrade pgaudit-debugsourceUpgrade postgresql16-debuginfoUpgrade postgresql-staticUpgrade postgis-upgrade-debuginfoUpgrade postgresql18-upgrade-develUpgrade postgresql18-server-debuginfoUpgrade pgvector | Jul 17, 2026 | May 14, 2026 |
| Rocky_linux | — | Upgrade postgresql-plpython3Upgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgradeUpgrade pg_repack-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresqlUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperlUpgrade postgresql-private-libsUpgrade postgresql-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-private-develUpgrade postgres-decoderbufs-debuginfoUpgrade pgauditUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade pg_repack | Aug 20, 2026 | Aug 18, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.2.6Upgrade Splunk Enterprise to version 9.4.14Upgrade Splunk Enterprise to version 10.0.9Upgrade Splunk Enterprise to version 10.4.2 | Aug 20, 2026 | May 14, 2026 |
| Ubuntu | — | Upgrade postgresql-17Upgrade postgresql-18Upgrade postgresql-14Upgrade postgresql-16 | May 25, 2026 | May 21, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 19, 2026 | May 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub