Critical Denial of Service Vulnerability in PostgreSQL Packages
Summary
ALSA-2026:52395: Important: postgresql security update. Affects postgresql versions < 13.23-5.el9_8. Fixed in 13.23-5.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and standards compliance. It supports a wide variety of data types and offers powerful features such as transactions, sub-selects, triggers, views, and stored procedures. However, it is susceptible to vulnerabilities that can compromise its performance and availability, such as the recent Denial of Service (DoS) issue identified in CVE-2026-6479.
Vulnerability Detail
The vulnerability arises from uncontrolled recursion during SSL/GSS negotiation in PostgreSQL, which can lead to a Denial of Service (DoS) condition. This issue allows an attacker to exploit the recursion flaw, potentially causing the database server to crash or become unresponsive. The ramifications of this vulnerability can be severe, affecting the availability of the database and disrupting services that rely on it. The technical details indicate that the flaw is rooted in the handling of SSL/GSS negotiation processes, which are critical for secure communications.
How To Fix
Minimum fixed version
13.23-5.el9_8
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate patching is not feasible, consider disabling SSL/GSS negotiation in your PostgreSQL configuration. However, this may compromise the security of your database communications, so it should only be used as a last resort until the update can be applied.
Conclusion
The Denial of Service vulnerability in PostgreSQL, identified as CVE-2026-6479, poses a significant risk to database availability. It is crucial for users to update their PostgreSQL packages to the patched version to mitigate this risk. Regular monitoring and prompt updates are essential to maintain the security of your database systems.
See every vulnerability recorded for postgresql →
FAQ
CVE-2026-6479 is a security vulnerability in PostgreSQL that allows for Denial of Service attacks due to uncontrolled recursion in SSL/GSS negotiation.
You can check your PostgreSQL version and compare it with the patched version (13.23-5.el9_8). Additionally, using tools like Vulert can help monitor for vulnerabilities.
Failure to address this vulnerability can lead to service outages, making your database unavailable to users and applications relying on it.
Yes, Vulert provides a solution that monitors open-source vulnerabilities in real-time using just a manifest file like package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring an account.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
