CRE-2025-0035
psycopg2 SSL error due to thread or forked process stateCriticalImpact: 7/10Mitigation: 6/10
CRE-2025-0035View on GitHub
Description
Applications using psycopg2 with OpenTelemetry instrumentation or threading may fail with SSL-related errors such as "decryption failed or bad record mac". This often occurs when a database connection is created before a fork or from an unsafe thread context, causing the SSL state to become invalid.
Mitigation
- Ensure all PostgreSQL connections are created after any forks (e.g., inside a worker thread or process). - Avoid sharing DB connections across threads or subprocesses. - If using uWSGI or gunicorn, configure with `--lazy-apps` or use gevent/thread-aware worker models. - Optionally disable OpenTelemetry DB instrumentation if it interferes with connection tracing.