CVE-2026-116322

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116322", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-26T03:52:44.053Z", "datePublished": "2026-11-12T14:15:12.887Z", "dateUpdated": "2026-11-12T21:46:20.429Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-12T14:15:12.887Z"}, "title": "PostgreSQL pre-authentication cancel request can leak a spinlock", "x_postgresql": {"component": "core server"}, "descriptions": [{"lang": "en", "value": "Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-667", "type": "CWE", "description": "Improper Locking"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-116322/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T21:21:48.203823Z", "id": "CVE-2026-116322", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T21:46:20.429Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}], "id": "CVE-2026-116322", "lastModified": "2026-11-12T22:18:27.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116322", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T21:21:48.203823Z", "version": "2.0.3"}}]}, "published": "2026-11-12T15:17:40.707", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.postgresql.org/support/security/CVE-2026-116322/"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql: postgresql: Denial of Service via improper locking during startup processing", "id": "2572558", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572558"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-413", "details": ["A flaw was found in PostgreSQL. An unauthenticated remote attacker can cause a Denial of Service (DoS) by triggering an unexpected server restart. This issue occurs due to improper locking during startup processing when an authentication timeout occurs while a lock is held during cancel handling."], "mitigation": {"lang": "en:us", "value": "Restrict network exposure by limiting access to the PostgreSQL service to trusted hosts and subnets only, or configure the daemon to listen solely on localhost if remote connections are not required.\n1. Restrict inbound network traffic using firewalld:\n```\nfirewall-cmd --permanent --zone=public --remove-service=postgresql\nfirewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR>\nfirewall-cmd --reload\n```\n2. Alternatively, configure PostgreSQL to listen only on localhost in postgresql.conf:\n```\nlisten_addresses = 'localhost'\n```\nApply the configuration changes by restarting the service:\n```\nsystemctl restart postgresql\n```\nWarning: Restarting or reloading the PostgreSQL service will disrupt active client connections. Restricting firewall rules or listening interfaces will prevent connections from non-allowlisted network clients, potentially impacting dependent applications if trusted endpoints are not configured correctly."}, "name": "CVE-2026-116322", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libpq", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql17", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql18", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-12T14:15:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116322\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116322\nhttps://www.postgresql.org/support/security/CVE-2026-116322/"], "statement": "This vulnerability is rated as Moderate because an unauthenticated remote attacker can trigger an unexpected database service restart, resulting in a temporary denial of service without compromising data integrity or confidentiality. Successful exploitation requires specific timing to force a timeout during early connection processing, limiting the blast radius solely to service availability. In standard Red Hat enterprise environments, database instances are typically isolated from direct exposure to untrusted public networks, further reducing operational risk.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18,18.7)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PostgreSQL", "source": "cna", "vendor": "n/a"}, "product": "postgresql", "vendor": "postgresql"}], "created": "2026-11-12T23:45:10.756177+00:00", "updated": "2026-11-13T05:45:15.831161+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$postgresql"]}