PostgreSQL: Persistent denial of service in dblink and CREATE/ALTER SUBSCRIPTION
PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION functionality allows unauthorized file modification via the sslkeylogfile parameter, resulting in potential persistent denial of service.
CVE search metadata
CVE search record: CVE-2026-14661. Severity: high. CVSS: 8.1. KEV: no. Brief: PostgreSQL: Persistent denial of service in dblink and CREATE/ALTER SUBSCRIPTION. Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-14661/
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION functionality contains a vulnerability involving external control of file names. The 'sslkeylogfile' connection parameter allows a user to append data in NSS keylog format to a chosen file. This mechanism does not allow for arbitrary byte injection, but the resulting file modification can lead to a persistent denial of service.
Impact
Successful exploitation results in a persistent denial of service through the appending of invalid data to a file of the user's choosing.
Recommendation
Review database connection parameters and usage of dblink and subscription management functions to prevent unauthorized file manipulation.