UpHeron
All vulnerabilities

Servers and applications

CVE-2026-116322

PostgreSQL pre-authentication cancel request can leak a spinlock

Severity
Medium 5.3
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
18.7
Exploit chance
0.4% in the next 30 daysHigher than 30% of CVEs. EPSS by FIRST, 13 Nov 2026
Weakness
CWE-667
Attack
Over the network · No login needed · No user action needed
Attacker can
Slow it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Sources
CVE Program

Description

Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

From the CVE Program.

Affected software

SoftwareAffected versions
PostgreSQLServers and applications · cna:n/a|postgresql
  • From 18 before 18.7

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-116322