postgres-github.git / summary / log / commit / refs

commit    b63f25bddfebc67b1e78f86341a6aecb0e9fe576
Author:   Michael Paquier <michael@paquier.xyz>
Commit:   Noah Misch <noah@leadboat.com>
Date:     Mon May 11 12:13:46 2026 +0000

    Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket()
    
    The handling of SSL and GSS negotiation messages in
    ProcessStartupPacket() could cause a recursion of the backend,
    ultimately crashing the server as the negotiation attempts were not
    tracked across multiple calls processing startup packets.
    
    A malicious client could therefore alternate rejected SSL and GSS
    requests indefinitely, each adding a stack frame, until the backend
    crashed with a stack overflow, taking down a server.
    
    This commit addresses this issue by modifying ProcessStartupPacket() so
    as processed negotiation attempts are tracked, preventing infinite
    recursive attempts.  A TAP test is added to check this problem, where
    multiple SSL and GSS negotiated attempts are stacked.
    
    Reported-by: Calif.io in collaboration with Claude and Anthropic
    Research
    Author: Michael Paquier <michael@paquier.xyz>
    Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
    Security: CVE-2026-6479
    Backpatch-through: 14

[parent: c55cea529064]