PostgreSQL patches 52 flaws, including authenticated RCE
CVE-2026-6460, CVSS 8.8, needs object-creation rights; full protection also requires rebuilding C extensions.
76
Vulnerability1 · 1 read
CVE-2026-116322
Unauthenticated restart DoS in PostgreSQL 18 before 18.7
- CVSS 3.1
- 5.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Improper locking in PostgreSQL startup processing lets an unauthenticated network client force a server restart. The client arranges for authentication_timeout to fire while it holds a spinlock during cancel handling. Impact is limited to availability (a restart). Only PostgreSQL 18 minor versions before 18.7 are affected; releases before major version 18 are not.
What to do: Upgrade PostgreSQL 18 to 18.7. No workaround is named.
| Product | Affected | Fixed in |
|---|---|---|
| PostgreSQL | 18 before 18.7 | 18.7 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
- Weakness
- CWE-667
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L