> On 20 Sep 2026, at 23:16, Noah Misch <noah@leadboat.com> wrote:
> security@ received a report about a NULL pointer SIGSEGV in $SUBJECT. I'm
> attaching the reporter's materials.
When reloading SSL configuration fails, we retain the previous config, but the
ssl_sni GUC was changed which could lead to new connections trying to access
SSL config which didn't exist. The proposed fix is to allow mismatched SSL
config and ssl_sni settings which I think is more confusing than treating
ssl_sni like the rest of the SSL config and retaining it's value on config
reload failure. The attached v2 does that, adds a WARNING (on top of the
already present logged warning) and expands the tests from the original
submission.
--
Daniel Gustafsson
