CVE-2026-116322 PostgreSQL pre-authentication cancel request can leak a spinlock

This vulnerability is rated as Moderate because an unauthenticated remote attacker can trigger an unexpected database service restart, resulting in a temporary denial of service without compromising data integrity or confidentiality. Successful exploitation requires specific timing to force a timeout during early connection processing, limiting the blast radius solely to service availability. In standard Red Hat enterprise environments, database instances are typically isolated from direct exposure to untrusted public networks, further reducing operational risk.

Restrict network exposure by limiting access to the PostgreSQL service to trusted hosts and subnets only, or configure the daemon to listen solely on localhost if remote connections are not required.

1. Restrict inbound network traffic using firewalld:

```

firewall-cmd --permanent --zone=public --remove-service=postgresql

firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR>

firewall-cmd --reload

```

2. Alternatively, configure PostgreSQL to listen only on localhost in postgresql.conf:

```

listen_addresses = 'localhost'

```

Apply the configuration changes by restarting the service:

```

systemctl restart postgresql

```

Warning: Restarting or reloading the PostgreSQL service will disrupt active client connections. Restricting firewall rules or listening interfaces will prevent connections from non-allowlisted network clients, potentially impacting dependent applications if trusted endpoints are not configured correctly.