agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac 6+ messages / 1 participants [nested] [flat]
* pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket() The handling of SSL and GSS negotiation messages in ProcessStartupPacket() could cause a recursion of the backend, ultimately crashing the server as the negotiation attempts were not tracked across multiple calls processing startup packets. A malicious client could therefore alternate rejected SSL and GSS requests indefinitely, each adding a stack frame, until the backend crashed with a stack overflow, taking down a server. This commit addresses this issue by modifying ProcessStartupPacket() so as processed negotiation attempts are tracked, preventing infinite recursive attempts. A TAP test is added to check this problem, where multiple SSL and GSS negotiated attempts are stacked. Reported-by: Calif.io in collaboration with Claude and Anthropic Research Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Security: CVE-2026-6479 Backpatch-through: 14 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/b63f25bddfebc67b1e78f86341a6aecb0e9fe576 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/tcop/backend_startup.c | 25 +++++++++- src/test/postmaster/meson.build | 1 + src/test/postmaster/t/004_negotiate.pl | 83 ++++++++++++++++++++++++++++++++++ 3 files changed, 107 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket() The handling of SSL and GSS negotiation messages in ProcessStartupPacket() could cause a recursion of the backend, ultimately crashing the server as the negotiation attempts were not tracked across multiple calls processing startup packets. A malicious client could therefore alternate rejected SSL and GSS requests indefinitely, each adding a stack frame, until the backend crashed with a stack overflow, taking down a server. This commit addresses this issue by modifying ProcessStartupPacket() so as processed negotiation attempts are tracked, preventing infinite recursive attempts. A TAP test is added to check this problem, where multiple SSL and GSS negotiated attempts are stacked. Reported-by: Calif.io in collaboration with Claude and Anthropic Research Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Security: CVE-2026-6479 Backpatch-through: 14 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/f7a191f5377dacd05d22dd40c1d1e38b393ea9b4 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/tcop/backend_startup.c | 23 +++++++++- src/test/postmaster/meson.build | 1 + src/test/postmaster/t/004_negotiate.pl | 82 ++++++++++++++++++++++++++++++++++ 3 files changed, 104 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket() The handling of SSL and GSS negotiation messages in ProcessStartupPacket() could cause a recursion of the backend, ultimately crashing the server as the negotiation attempts were not tracked across multiple calls processing startup packets. A malicious client could therefore alternate rejected SSL and GSS requests indefinitely, each adding a stack frame, until the backend crashed with a stack overflow, taking down a server. This commit addresses this issue by modifying ProcessStartupPacket() so as processed negotiation attempts are tracked, preventing infinite recursive attempts. A TAP test is added to check this problem, where multiple SSL and GSS negotiated attempts are stacked. Reported-by: Calif.io in collaboration with Claude and Anthropic Research Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Security: CVE-2026-6479 Backpatch-through: 14 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/32a4ce55ccabe4c1e9b1e45d4efc1e62e69fc754 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/tcop/backend_startup.c | 23 +++++++++- src/test/Makefile | 2 +- src/test/meson.build | 1 + src/test/postmaster/.gitignore | 2 + src/test/postmaster/Makefile | 23 ++++++++++ src/test/postmaster/README | 27 +++++++++++ src/test/postmaster/meson.build | 12 +++++ src/test/postmaster/t/004_negotiate.pl | 82 ++++++++++++++++++++++++++++++++++ 8 files changed, 169 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket() The handling of SSL and GSS negotiation messages in ProcessStartupPacket() could cause a recursion of the backend, ultimately crashing the server as the negotiation attempts were not tracked across multiple calls processing startup packets. A malicious client could therefore alternate rejected SSL and GSS requests indefinitely, each adding a stack frame, until the backend crashed with a stack overflow, taking down a server. This commit addresses this issue by modifying ProcessStartupPacket() so as processed negotiation attempts are tracked, preventing infinite recursive attempts. A TAP test is added to check this problem, where multiple SSL and GSS negotiated attempts are stacked. Reported-by: Calif.io in collaboration with Claude and Anthropic Research Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Security: CVE-2026-6479 Backpatch-through: 14 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/66cf26b9e4be1b46a5039bb7ea37f65d1e52e763 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/postmaster/postmaster.c | 23 +++++++++- src/test/Makefile | 2 +- src/test/meson.build | 1 + src/test/postmaster/.gitignore | 2 + src/test/postmaster/Makefile | 23 ++++++++++ src/test/postmaster/README | 27 ++++++++++++ src/test/postmaster/meson.build | 12 +++++ src/test/postmaster/t/004_negotiate.pl | 81 ++++++++++++++++++++++++++++++++++ 8 files changed, 168 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket() The handling of SSL and GSS negotiation messages in ProcessStartupPacket() could cause a recursion of the backend, ultimately crashing the server as the negotiation attempts were not tracked across multiple calls processing startup packets. A malicious client could therefore alternate rejected SSL and GSS requests indefinitely, each adding a stack frame, until the backend crashed with a stack overflow, taking down a server. This commit addresses this issue by modifying ProcessStartupPacket() so as processed negotiation attempts are tracked, preventing infinite recursive attempts. A TAP test is added to check this problem, where multiple SSL and GSS negotiated attempts are stacked. Reported-by: Calif.io in collaboration with Claude and Anthropic Research Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Security: CVE-2026-6479 Backpatch-through: 14 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/3fb66d3022f7bf89143f1452e030d86bd0e1f58e Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/postmaster/postmaster.c | 23 +++++++++- src/test/Makefile | 2 +- src/test/postmaster/.gitignore | 2 + src/test/postmaster/Makefile | 23 ++++++++++ src/test/postmaster/README | 27 ++++++++++++ src/test/postmaster/t/004_negotiate.pl | 81 ++++++++++++++++++++++++++++++++++ 6 files changed, 155 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket() The handling of SSL and GSS negotiation messages in ProcessStartupPacket() could cause a recursion of the backend, ultimately crashing the server as the negotiation attempts were not tracked across multiple calls processing startup packets. A malicious client could therefore alternate rejected SSL and GSS requests indefinitely, each adding a stack frame, until the backend crashed with a stack overflow, taking down a server. This commit addresses this issue by modifying ProcessStartupPacket() so as processed negotiation attempts are tracked, preventing infinite recursive attempts. A TAP test is added to check this problem, where multiple SSL and GSS negotiated attempts are stacked. Reported-by: Calif.io in collaboration with Claude and Anthropic Research Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Security: CVE-2026-6479 Backpatch-through: 14 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/3b4e66739aa5bad84ad439ab9776e3b8dc4ef290 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/postmaster/postmaster.c | 23 +++++++++- src/test/Makefile | 2 +- src/test/postmaster/.gitignore | 2 + src/test/postmaster/Makefile | 23 ++++++++++ src/test/postmaster/README | 27 ++++++++++++ src/test/postmaster/t/004_negotiate.pl | 81 ++++++++++++++++++++++++++++++++++ 6 files changed, 155 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-05-11 12:19 UTC | newest] Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-05-11 12:19 pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Fix unbounded recursive handling of SSL/GSS in ProcessStartupPac Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox