Medium [CVE-2026-6470] Denial of Service via missing authorization in DDL commands

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not.

Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. A flaw was found in PostgreSQL where missing authorization checks in DDL commands allow an authenticated user to create unauthorized dependencies on a data type (such as when assigning a range subtype or referencing the type in an SQL expression).

This allows the user to block legitimate owners from altering or dropping that type, resulting in a targeted denial-of-service condition on the affected database object. This Moderate impact flaw allows an authenticated user with object creation rights to cause a targeted denial of service in PostgreSQL.

Missing authorization checks during specific DDL operations allow an attacker to create type dependencies that block legitimate ALTER and DROP commands, preventing routine administrative management of affected data types. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Weakness: CWE-862.