Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket()
Michael Paquier <michael@paquier.xyz>
Author:
Michael Paquier <michael@paquier.xyz>
Committer:
Noah Misch <noah@leadboat.com>
Date: 2026-05-11T12:13:47Z
Releases:
18.4
Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket() The handling of SSL and GSS negotiation messages in ProcessStartupPacket() could cause a recursion of the backend, ultimately crashing the server as the negotiation attempts were not tracked across multiple calls processing startup packets. A malicious client could therefore alternate rejected SSL and GSS requests indefinitely, each adding a stack frame, until the backend crashed with a stack overflow, taking down a server. This commit addresses this issue by modifying ProcessStartupPacket() so as processed negotiation attempts are tracked, preventing infinite recursive attempts. A TAP test is added to check this problem, where multiple SSL and GSS negotiated attempts are stacked. Reported-by: Calif.io in collaboration with Claude and Anthropic Research Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Security: CVE-2026-6479 Backpatch-through: 14
Files
| Path | Change | +/− |
|---|---|---|
| src/backend/tcop/backend_startup.c | modified | +21 −2 |
| src/test/postmaster/meson.build | modified | +1 −0 |
| src/test/postmaster/t/004_negotiate.pl | added | +82 −0 |