CVE-2026-116322 · Runtime
NO FIX YET · SEE WHAT TO DO
A race in PostgreSQL's startup handling, where authentication_timeout fires while a spinlock is held during cancel handling, can crash the server. An unauthenticated network client can trigger it by arranging the timing, forcing a server restart.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any PostgreSQL 18 server that accepts network connections is in scope, since the trigger comes from an unauthenticated client during startup. Servers on earlier major versions are not affected according to the description. Servers reachable only from a trusted local machine or behind a tightly restricted network are lower exposure.
Not affected if local-only-access, pre-18-major-version
Who cares database, postgresql, self-hosted
SELECT version(); in psql and confirm the server is major version 18 with a minor version below 18.7postgres --version18.7: move to 18.7 or laterImproper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.