PostgreSQL: Denial of service via pre-authentication cancel request (CVE-2026-116322)
An unauthenticated remote attacker can trigger a server restart in PostgreSQL versions 18 through 18.6 by sending a specially crafted cancel request during the authentication process.
CVE search metadata
CVE search record: CVE-2026-116322. KEV: no. Product: PostgreSQL (< 18.7). Brief: PostgreSQL: Denial of service via pre-authentication cancel request (CVE-2026-116322). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-116322/
Triage facts
Revision 1- Applicability
- PostgreSQL (< 18.7)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 12, 16:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A vulnerability (CVE-2026-116322) in PostgreSQL allows an unauthenticated network client to trigger a server restart. The flaw exists due to improper locking in the startup processing logic. Specifically, an attacker can arrange for an authentication_timeout to occur while they hold a spinlock during cancel request handling. This vulnerability affects PostgreSQL major version 18, specifically minor versions prior to 18.7.
Impact
Successful exploitation results in a denial of service condition caused by an unexpected server restart.
Recommendation
Immediately upgrade all PostgreSQL 18 instances to version 18.7 or later to remediate the vulnerability. Administrators should prioritize patching internet-facing database instances.
Immediate actions
Upgrade all PostgreSQL 18.x instances to version 18.7 or later
Threat Hunt
Identify frequent, anomalous server restarts of PostgreSQL processes in system logs
Data: PostgreSQL error logs, Systemd service status logs
Mitigations
Patch PostgreSQL to 18.7
CVE-2026-116322