Critical Denial of Service Vulnerability in PostgreSQL Packages
Summary
ALSA-2026:52396: Important: postgresql:12 security update. Affects pg_repack versions < 1.4.6-3.module_el8.9.0+3704+f1f917ce. Fixed in 1.4.6-3.module_el8.9.0+3704+f1f917ce. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and support for complex queries. It is widely used in various applications for data storage and management. The recent vulnerability affects several packages associated with PostgreSQL, including pg_repack, pgaudit, and others, which could lead to a denial of service due to uncontrolled recursion during SSL/GSS negotiation.
Vulnerability Detail
The vulnerability, identified as CVE-2026-6479, arises from uncontrolled recursion in the SSL/GSS negotiation process within PostgreSQL. This flaw can be exploited to cause a denial of service, potentially leading to application downtime and loss of availability. Attackers can leverage this vulnerability to disrupt services by overwhelming the system with recursive calls, which can exhaust system resources.
How To Fix
Minimum fixed version
1.4.6-3.module_el8.9.0+3704+f1f917ce
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is strongly recommended to apply the available patches as soon as possible to mitigate the risk.
Conclusion
The vulnerability CVE-2026-6479 poses a significant risk to PostgreSQL packages, leading to potential denial of service. It is crucial for users to update their packages to the patched versions to mitigate this risk. Regular monitoring and updates are essential for maintaining the security of database systems.
See every vulnerability recorded for pg_repack →
FAQ
CVE-2026-6479 is a vulnerability in PostgreSQL that allows for denial of service due to uncontrolled recursion in SSL/GSS negotiation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The vulnerability can lead to denial of service, causing application downtime and loss of availability, which can affect business operations.
It is recommended to regularly check for updates and apply them promptly to ensure your system is secure against known vulnerabilities.
While the primary risk is denial of service, it is always advisable to have backups in place to prevent data loss in case of any unforeseen issues.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
