CVE-2026-116322

CVE Enrichment

CVSS: 5.3 MEDIUM
EPSS: 0.37%
EPSS Percentile: 30.90%
CISA KEV: Not listed

Description

Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Published: 12-Nov-2026 22:17
Last Modified: 13-Nov-2026 05:18
EPSS Date: 2026-11-13
CWE: CWE-667

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:N /
                            I:N /
                            A:L

CNA Products / Version Status

n/a · PostgreSQL Source: CNA · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Default status: unaffected

18 ≤ version < 18.7 — affected (rpm)

References

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Last enrichment sync: 14-Nov-2026 03:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

index, only one flaw in the server requires neither a login nor any user action. That flaw, CVE-2026-116322, lets an unauthenticated client trigger a restart of PostgreSQL 18 servers. PostgreSQL Fixes 52 Flaws, Including Type-Confusion Bug That Can Enable Code Execution

CVE (1)

People (1)

Vendors (7)

Products (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.