Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket()
Michael Paquier <michael@paquier.xyz>
Author:
Michael Paquier <michael@paquier.xyz>
Committer:
Noah Misch <noah@leadboat.com>
Date: 2026-05-11T12:13:51Z
Releases:
14.23
Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket() The handling of SSL and GSS negotiation messages in ProcessStartupPacket() could cause a recursion of the backend, ultimately crashing the server as the negotiation attempts were not tracked across multiple calls processing startup packets. A malicious client could therefore alternate rejected SSL and GSS requests indefinitely, each adding a stack frame, until the backend crashed with a stack overflow, taking down a server. This commit addresses this issue by modifying ProcessStartupPacket() so as processed negotiation attempts are tracked, preventing infinite recursive attempts. A TAP test is added to check this problem, where multiple SSL and GSS negotiated attempts are stacked. Reported-by: Calif.io in collaboration with Claude and Anthropic Research Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Security: CVE-2026-6479 Backpatch-through: 14
Files
| Path | Change | +/− |
|---|---|---|
| src/backend/postmaster/postmaster.c | modified | +21 −2 |
| src/test/Makefile | modified | +1 −1 |
| src/test/postmaster/.gitignore | added | +2 −0 |
| src/test/postmaster/Makefile | added | +23 −0 |
| src/test/postmaster/README | added | +27 −0 |
| src/test/postmaster/t/004_negotiate.pl | added | +81 −0 |