This vulnerability results from uncontrolled recursion during the initialization of SSL or GSS negotiation in PostgreSQL, a flaw classified as CWE‑674. An attacker who can connect to a PostgreSQL socket—either the Unix domain socket exposed via AF_UNIX or the TCP port when both SSL and GSS are disabled—can trigger the recursion and exhaust server resources, causing the database service to become unresponsive. The effect is a denial of service that can be sustained as long as the malicious connections continue.

The flaw affects PostgreSQL servers, specifically all releases prior to 18.4, 17.10, 16.14, 15.18, and 14.23. Any installation of PostgreSQL that exposes a local AF_UNIX socket or listens on a TCP socket without SSL/GSS enabled is at risk. The issue is present in the core PostgreSQL product.

The CVSS score of 7.5 indicates a high impact and moderate to high complexity, though the EPSS score is unavailable at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting no public exploitation has been recorded yet. Attackers need the ability to open a connection to the database socket, which could be local or network based depending on configuration, making the attack survivable in typical deployment scenarios. Once the recursion is triggered, the database becomes unresponsive until the service is restarted, producing repeatable denial of service.