Vulnerability · Published May 14, 2026 · Assigned by PostgreSQL

CVE-2026-6479PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

High 7.5

In plain English

A high-severity security flaw in PostgreSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 51.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8pg_repack1.5.1-1.module_el8.10.0+3930+ecf33554ALSA-2026:28143
AlmaLinux:8pg_repack1.5.1-1.module_el8.10.0+4125+ceaf7d1bALSA-2026:28143
AlmaLinux:8pg_repack1.4.6-3.module_el8.9.0+3704+f1f917ceALSA-2026:52396
AlmaLinux:8pg_repack1.4.8-1.module_el8.9.0+3706+885c732eALSA-2026:26181
AlmaLinux:8pg_repack1.5.1-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:9pg_repack1.4.8-2.module_el9.5.0+119+18833d03ALSA-2026:28037
AlmaLinux:9pg_repack1.5.1-1.module_el9.6.0+146+c54fdecaALSA-2026:26203
AlmaLinux:9pg_repack1.5.3-1.module_el9.8.0+234+5456f35dALSA-2026:26204
AlmaLinux:8pgaudit1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1ALSA-2026:52396
AlmaLinux:8pgaudit1.4.0-7.module_el8.10.0+3889+48cb11fb.alma.1ALSA-2026:52396
AlmaLinux:8pgaudit1.7.0-1.module_el8.9.0+3706+885c732eALSA-2026:26181
AlmaLinux:8pgaudit16.0-1.module_el8.10.0+3798+606ebb9fALSA-2026:28143
AlmaLinux:9pgaudit18.0-1.module_el9.8.0+234+5456f35dALSA-2026:26204
AlmaLinux:9pgaudit1.7.0-1.module_el9.3.0+52+21733919ALSA-2026:28037
AlmaLinux:9pgaudit16.0-1.module_el9.4.0+66+eb9878bcALSA-2026:26203
AlmaLinux:9pgvector0.8.1-1.module_el9.8.0+234+5456f35dALSA-2026:26204
AlmaLinux:9pgvector0.6.2-2.module_el9.6.0+167+4e561146ALSA-2026:26203
AlmaLinux:9postgis3.5.3-5.module_el9.8.0+236+2d3cbd4cALSA-2026:26203
AlmaLinux:9postgis3.6.1-2.module_el9.8.0+239+6fb51d38ALSA-2026:26204
AlmaLinux:9postgis-client3.5.3-5.module_el9.8.0+236+2d3cbd4cALSA-2026:26203
AlmaLinux:9postgis-client3.6.1-2.module_el9.8.0+239+6fb51d38ALSA-2026:26204
AlmaLinux:9postgis-docs3.5.3-5.module_el9.8.0+236+2d3cbd4cALSA-2026:26203
AlmaLinux:9postgis-docs3.6.1-2.module_el9.8.0+239+6fb51d38ALSA-2026:26204
AlmaLinux:9postgis-upgrade3.6.1-2.module_el9.8.0+239+6fb51d38ALSA-2026:26204
AlmaLinux:9postgis-upgrade3.5.3-5.module_el9.8.0+236+2d3cbd4cALSA-2026:26203
AlmaLinux:9postgis-utils3.5.3-5.module_el9.8.0+236+2d3cbd4cALSA-2026:26203
AlmaLinux:9postgis-utils3.6.1-2.module_el9.8.0+239+6fb51d38ALSA-2026:26204
AlmaLinux:8postgres-decoderbufs2.4.0-1.Final.module_el8.10.0+3798+606ebb9fALSA-2026:28143
AlmaLinux:8postgres-decoderbufs1.9.7-1.Final.module_el8.9.0+3706+885c732eALSA-2026:26181
AlmaLinux:8postgres-decoderbufs0.10.0-2.module_el8.9.0+3704+f1f917ceALSA-2026:52396
AlmaLinux:9postgres-decoderbufs1.9.7-1.Final.module_el9.3.0+52+21733919ALSA-2026:28037
AlmaLinux:9postgres-decoderbufs2.4.0-1.Final.module_el9.4.0+66+eb9878bcALSA-2026:26203
AlmaLinux:9postgres-decoderbufs3.3.1-1.Final.module_el9.8.0+234+5456f35dALSA-2026:26204
AlmaLinux:10postgresql16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql12.22-9.module_el8.10.0+4249+5ffd6db7ALSA-2026:52396
AlmaLinux:8postgresql15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:8postgresql16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:9postgresql13.23-5.el9_8ALSA-2026:52395
AlmaLinux:9postgresql16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:10postgresql-contrib16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-contrib16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:8postgresql-contrib12.22-9.module_el8.10.0+4249+5ffd6db7ALSA-2026:52396
AlmaLinux:8postgresql-contrib15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:9postgresql-contrib18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql-contrib15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:9postgresql-contrib13.23-5.el9_8ALSA-2026:52395
AlmaLinux:9postgresql-contrib16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:10postgresql-docs16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-docs15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:8postgresql-docs16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:9postgresql-docs13.23-5.el9_8ALSA-2026:52395
AlmaLinux:9postgresql-docs18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql-docs16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql-docs15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:10postgresql-plperl16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-plperl15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:8postgresql-plperl16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:9postgresql-plperl15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:9postgresql-plperl18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql-plperl16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql-plperl13.23-5.el9_8ALSA-2026:52395
AlmaLinux:10postgresql-plpython316.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-plpython316.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:8postgresql-plpython315.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:9postgresql-plpython315.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:9postgresql-plpython318.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql-plpython316.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql-plpython313.23-5.el9_8ALSA-2026:52395
AlmaLinux:10postgresql-pltcl16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-pltcl16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:8postgresql-pltcl15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:9postgresql-pltcl16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql-pltcl18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql-pltcl13.23-5.el9_8ALSA-2026:52395
AlmaLinux:9postgresql-pltcl15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:10postgresql-private-devel16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-private-devel16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:8postgresql-private-devel15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:9postgresql-private-devel13.23-5.el9_8ALSA-2026:52395
AlmaLinux:9postgresql-private-devel15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:9postgresql-private-devel16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql-private-devel18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:10postgresql-private-libs16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-private-libs15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:8postgresql-private-libs16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:9postgresql-private-libs16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql-private-libs18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql-private-libs13.23-5.el9_8ALSA-2026:52395
AlmaLinux:9postgresql-private-libs15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:10postgresql-server16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-server15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:8postgresql-server16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:9postgresql-server18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql-server15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:9postgresql-server16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql-server13.23-5.el9_8ALSA-2026:52395
AlmaLinux:10postgresql-server-devel16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-server-devel16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:8postgresql-server-devel15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:9postgresql-server-devel18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql-server-devel13.23-5.el9_8ALSA-2026:52395
AlmaLinux:9postgresql-server-devel16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql-server-devel15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:10postgresql-static16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-static16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:8postgresql-static15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:9postgresql-static16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql-static15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:9postgresql-static18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql-static13.23-5.el9_8ALSA-2026:52395
AlmaLinux:10postgresql-test16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-test16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:8postgresql-test15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:9postgresql-test15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:9postgresql-test18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql-test13.23-5.el9_8ALSA-2026:52395
AlmaLinux:9postgresql-test16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:10postgresql-test-rpm-macros16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-test-rpm-macros15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:8postgresql-test-rpm-macros16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:9postgresql-test-rpm-macros13.23-5.el9_8ALSA-2026:52395
AlmaLinux:9postgresql-test-rpm-macros16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql-test-rpm-macros15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:9postgresql-test-rpm-macros18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:10postgresql-upgrade16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-upgrade16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:8postgresql-upgrade12.22-9.module_el8.10.0+4249+5ffd6db7ALSA-2026:52396
AlmaLinux:8postgresql-upgrade15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:9postgresql-upgrade16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:9postgresql-upgrade15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:9postgresql-upgrade13.23-5.el9_8ALSA-2026:52395
AlmaLinux:9postgresql-upgrade18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:10postgresql-upgrade-devel16.14-1.el10_2ALSA-2026:27743
AlmaLinux:8postgresql-upgrade-devel16.14-1.module_el8.10.0+4199+bf03c564ALSA-2026:28143
AlmaLinux:8postgresql-upgrade-devel15.18-1.module_el8.10.0+4195+4569d728ALSA-2026:26181
AlmaLinux:8postgresql-upgrade-devel12.22-9.module_el8.10.0+4249+5ffd6db7ALSA-2026:52396
AlmaLinux:9postgresql-upgrade-devel15.18-1.module_el9.8.0+267+7c71b4a4ALSA-2026:28037
AlmaLinux:9postgresql-upgrade-devel13.23-5.el9_8ALSA-2026:52395
AlmaLinux:9postgresql-upgrade-devel18.4-2.module_el9.8.0+280+5ad12178ALSA-2026:26204
AlmaLinux:9postgresql-upgrade-devel16.14-1.module_el9.8.0+266+1e661e97ALSA-2026:26203
AlmaLinux:10postgresql1818.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-contrib18.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-docs18.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-plperl18.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-plpython318.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-private-devel18.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-private-libs18.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-server18.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-server-devel18.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-static18.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-test18.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-test-rpm-macros18.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-upgrade18.4-1.el10_2ALSA-2026:27742
AlmaLinux:10postgresql18-upgrade-devel18.4-1.el10_2ALSA-2026:27742
Alpine:v3.20postgresql1515.18-r0ALPINE-CVE-2026-6479
Alpine:v3.21postgresql1515.18-r0ALPINE-CVE-2026-6479
Alpine:v3.22postgresql1515.18-r0ALPINE-CVE-2026-6479
Alpine:v3.20postgresql1616.14-r0ALPINE-CVE-2026-6479
Alpine:v3.21postgresql1616.14-r0ALPINE-CVE-2026-6479
Alpine:v3.22postgresql1616.14-r0ALPINE-CVE-2026-6479
Alpine:v3.23postgresql1616.14-r0ALPINE-CVE-2026-6479
Alpine:v3.24postgresql1616.14-r0ALPINE-CVE-2026-6479
Alpine:v3.21postgresql1717.10-r0ALPINE-CVE-2026-6479
Alpine:v3.22postgresql1717.10-r0ALPINE-CVE-2026-6479
Alpine:v3.23postgresql1717.10-r0ALPINE-CVE-2026-6479
Alpine:v3.24postgresql1717.10-r0ALPINE-CVE-2026-6479
Alpine:v3.23postgresql1818.4-r0ALPINE-CVE-2026-6479
Alpine:v3.24postgresql1818.4-r0ALPINE-CVE-2026-6479
Debian:12postgresql-1515.18-0+deb12u1DEBIAN-CVE-2026-6479
Debian:13postgresql-1717.10-0+deb13u1DEBIAN-CVE-2026-6479
Debian:14postgresql-1818.4-1DEBIAN-CVE-2026-6479
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.10.0+40055+b85d5ce2RLSA-2026:52396
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.10.0+1862+29bef648RLSA-2026:52396
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1603+444d1b54RLSA-2026:52396
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1594+4a6adae9RLSA-2026:52396
Rocky Linux:8pgaudit0:1.4.0-7.module+el8.9.0+1735+a332307bRLSA-2026:52396
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.10.0+1862+29bef648RLSA-2026:52396
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.10.0+40055+b85d5ce2RLSA-2026:52396
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.9.0+1594+4a6adae9RLSA-2026:52396
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.9.0+1603+444d1b54RLSA-2026:52396
Rocky Linux:8postgresql0:12.22-9.module+el8.10.0+40272+1a01806bRLSA-2026:52396
Rocky Linux:9postgresql0:13.23-5.el9_8RLSA-2026:52395
Ubuntu:22.04:LTSpostgresql-1414.23-0ubuntu0.22.04.1UBUNTU-CVE-2026-6479
Ubuntu:24.04:LTSpostgresql-1616.14-0ubuntu0.24.04.1UBUNTU-CVE-2026-6479
Ubuntu:25.10postgresql-1717.10-0ubuntu0.25.10.1UBUNTU-CVE-2026-6479
Ubuntu:26.04:LTSpostgresql-1818.4-0ubuntu0.26.04.1UBUNTU-CVE-2026-6479

Affected products (as reported)

VendorProductVersions
n/a PostgreSQL 18 – before 18.417 – before 17.1016 – before 16.1415 – before 15.180 – before 14.23

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References