REDHAT-BUG-2572558: Medium severity PostgreSQL postgresql vulnerability

Q: Which deployments are affected?

Only PostgreSQL 18 installations running a minor release earlier than 18.7 are affected. PostgreSQL versions before 18 are unaffected.

Q: What access does an attacker need to trigger the issue?

An attacker only needs unauthenticated network access to the PostgreSQL server. The condition is triggered by timing authentication_timeout while holding a spinlock during cancel handling.

Q: What is the practical impact?

A successful attack can force the PostgreSQL server to restart, causing a denial of service.

Published Nov 12, 2026

Updated

Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authenticationtimeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

Affected Software

1 affected component

PostgreSQL postgresql>=18.0<18.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7

Event History

Nov 12, 2026

Data Sourced

via Red Hat·02:33 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

Only PostgreSQL 18 installations running a minor release earlier than 18.7 are affected. PostgreSQL versions before 18 are unaffected.

What access does an attacker need to trigger the issue?

An attacker only needs unauthenticated network access to the PostgreSQL server. The condition is triggered by timing authentication_timeout while holding a spinlock during cancel handling.

What is the practical impact?

A successful attack can force the PostgreSQL server to restart, causing a denial of service.

REDHAT-BUG-2572558: Medium severity PostgreSQL postgresql vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to trigger the issue?

What is the practical impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to trigger the issue?

What is the practical impact?