> On 20 Sep 2026, at 23:16, Noah Misch <[email protected]> wrote: > security@ received a report about a NULL pointer SIGSEGV in $SUBJECT. I'm > attaching the reporter's materials.
When reloading SSL configuration fails, we retain the previous config, but the ssl_sni GUC was changed which could lead to new connections trying to access SSL config which didn't exist. The proposed fix is to allow mismatched SSL config and ssl_sni settings which I think is more confusing than treating ssl_sni like the rest of the SSL config and retaining it's value on config reload failure. The attached v2 does that, adds a WARNING (on top of the already present logged warning) and expands the tests from the original submission. -- Daniel Gustafsson
v2-0001-Keep-current-ssl_sni-setting-on-SSL-config-reload.patch
Description: Binary data
