TLDR Dev · ARTICLES & TUTORIALS

CTRL-C IN PSQL GIVES ME THE HEEBIE-JEEBIES

neon.com14 min read

Summary from the TLDR Dev newsletter

The article uncovers a significant security vulnerability in how the `psql` command-line tool cancels PostgreSQL queries. When a user presses Ctrl-C, `psql` sends a `CancelRequest` over a new and separate connection that is always unencrypted, even if the main database connection is secured with TLS. This plaintext transmission creates a Denial-of-Service risk, as an attacker monitoring network traffic could intercept and replay these requests to cancel future queries on the same connection.