CVE-2026-116322: PostgreSQL pre-authentication cancel request can leak a spinlock
Vendor not yet named
No distribution fix yet for Debian 12/13 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
DescriptionNVD
Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Fix status by distribution
From each distribution’s security tracker. Distributions we did not check are not listed.
- Debian 13Affected, no fix releasedchecked 13 Nov 03:30 UTC
- Debian 12Affected, no fix releasedchecked 13 Nov 03:30 UTC
What changed
Debian status tracked since 13 Nov 2026.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 13 Nov.
- PostgreSQL fixes 52 flaws, including code execution bugsSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.