CVE-2026-116322: PostgreSQL pre-authentication cancel request can leak a spinlock
Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authenticationtimeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Which PostgreSQL deployments are affected?
Only PostgreSQL 18 installations running a minor version earlier than 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Does exploitation require authentication or user interaction?
No. An unauthenticated network client can trigger the condition, and no user interaction is required.
What is the impact of successful exploitation?
Successful exploitation can trigger a server restart, resulting in an availability impact.
What should teams do if they cannot patch immediately?
The provided information does not describe a workaround. Prioritize limiting unauthenticated network access to the PostgreSQL service until upgrading to PostgreSQL 18.7 or later.