{"id":"CVE-2026-116322","kind":"vulnerability","aliases":["CVE-2026-116322"],"related":[],"title":"PostgreSQL: startup locking flaw lets an unauthenticated client restart the server","description":"Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected.","summary":"A race in PostgreSQL's startup handling, where authentication_timeout fires while a spinlock is held during cancel handling, can crash the server. An unauthenticated network client can trigger it by arranging the timing, forcing a server restart.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["local-only-access","pre-18-major-version"],"how_to_check":"- Run `SELECT version();` in psql and confirm the server is major version 18 with a minor version below `18.7`\n- Check the running server version with `postgres --version`","fix":"- PostgreSQL 18 minor versions before `18.7`: move to `18.7` or later\n- Versions before PostgreSQL 18 are unaffected","status":"open","published_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","triaged_at":"2026-11-12T15:43:56+00:00","updated_at":"2026-11-12T15:43:56+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:56Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL 18 minor versions before `18.7`: move to `18.7` or later\n- Versions before PostgreSQL 18 are unaffected","reach":"network","title":"PostgreSQL: startup locking flaw lets an unauthenticated client restart the server","impact":"low","summary":"A race in PostgreSQL's startup handling, where authentication_timeout fires while a spinlock is held during cancel handling, can crash the server. An unauthenticated network client can trigger it by arranging the timing, forcing a server restart.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated network client forces repeated server restarts, causing denial of service","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and confirm the server is major version 18 with a minor version below `18.7`\n- Check the running server version with `postgres --version`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["pre-18-major-version","local-only-access"],"who_is_affected":"Any PostgreSQL 18 server that accepts network connections is in scope, since the trigger comes from an unauthenticated client during startup. Servers on earlier major versions are not affected according to the description. Servers reachable only from a trusted local machine or behind a tightly restricted network are lower exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000729,"input_tokens":4570,"output_tokens":544,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116322':14A,17A '-2026':13A,16A '18':96C,107C '18.7':101C 'affect':103C 'allow':68C 'arrang':55B,79C 'arriv':84C 'authent':32B,81C 'cancel':41B,91C 'client':8A,50B,72C 'crash':44B 'cve':12A,15A 'databas':18B 'fire':34B 'flaw':4A 'forc':58B 'handl':30B,42B,92C 'held':39B 'hold':87C 'host':23B 'improp':62C 'let':5A 'lock':3A,63C 'major':94C 'minor':97C 'network':49B,71C 'postgresql':1A,19B,27B,65C,100C,106C 'process':67C 'race':25B 'restart':9A,61B,77C 'runtim':20B 'self':22B 'self-host':21B 'server':11A,46B,60B,76C 'spinlock':37B,89C 'startup':2A,29B,66C 'time':57B 'timeout':33B,82C 'trigger':52B,74C 'unaffect':109C 'unauthent':7A,48B,70C 'version':95C,98C,104C 'via':78C 'within':93C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL 18 server that accepts network connections is in scope, since the trigger comes from an unauthenticated client during startup. Servers on earlier major versions are not affected according to the description. Servers reachable only from a trusted local machine or behind a tightly restricted network are lower exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","medium","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116322':14A,17A '-2026':13A,16A 'client':8A 'cve':12A,15A 'flaw':4A 'let':5A 'lock':3A 'postgresql':1A 'restart':9A 'server':11A 'startup':2A 'unauthent':7A","search_b":"'arrang':55B 'authent':32B 'cancel':41B 'client':50B 'crash':44B 'databas':18B 'fire':34B 'forc':58B 'handl':30B,42B 'held':39B 'host':23B 'network':49B 'postgresql':19B,27B 'race':25B 'restart':61B 'runtim':20B 'self':22B 'self-host':21B 'server':46B,60B 'spinlock':37B 'startup':29B 'time':57B 'timeout':33B 'trigger':52B 'unauthent':48B","search_c":"'18':96C,107C '18.7':101C 'affect':103C 'allow':68C 'arrang':79C 'arriv':84C 'authent':81C 'cancel':91C 'client':72C 'handl':92C 'hold':87C 'improp':62C 'lock':63C 'major':94C 'minor':97C 'network':71C 'postgresql':65C,100C,106C 'process':67C 'restart':77C 'server':76C 'spinlock':89C 'startup':66C 'timeout':82C 'trigger':74C 'unaffect':109C 'unauthent':70C 'version':95C,98C,104C 'via':78C 'within':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116322","severity":null,"published_at":"2026-11-12T15:17:40+00:00","modified_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","fetched_at":"2026-11-12T15:41:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}