Cyber Posture

CVE-2026-6479

High

Published: 14 May 2026

Published
14 May 2026
Modified
14 May 2026
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score N/A
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-6479 is a high-severity Uncontrolled Recursion (CWE-674) vulnerability in Postgresql (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, it is not currently listed in the CISA KEV catalog.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CP-7 Alternate Processing Site
addresses: CWE-674

Supports resumption at alternate site when uncontrolled recursion causes primary site failure or crash.

SC-5 Denial-of-service Protection
addresses: CWE-674

Prevents uncontrolled recursion that exhausts stack or CPU resources.

NVD Description

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access…

more

to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-674

Affected Products

Postgresql
—
inferred from references and description; NVD did not file a CPE for this CVE

References