5432
Summary
- // if you see it open
- Brute-force against exposed instances; misconfigured pg_hba.conf (trust auth on a public interface) yields unauthenticated access; CVE-2019-9193 COPY FROM/TO PROGRAM (project position: intended privileged functionality, not a vuln; widely used as post-auth RCE). Use SCRAM-SHA-256 and TLS; avoid public exposure.
- // common applications
- PostgreSQLPgBouncerPatroniCitus
- // analyst note
- A public 5432 is a misconfiguration and high-priority finding; check for default
postgrescredentials,trustauth, and superuser exposure.
About port 5432/tcp.
Port 5432/tcp is the default listener for the PostgreSQL database server, registered with IANA as postgresql with the description "PostgreSQL Database." The registration dates to a request on the pgsql-hackers mailing list around 2001, and PostgreSQL's own protocol documentation states that 5432 "has been registered with IANA as the customary TCP port number for servers supporting this protocol"; the number itself carries no special meaning beyond having been free at the time. The protocol is a message-based frontend/backend wire protocol over TCP or Unix sockets: the client opens with a startup message declaring the protocol version (3.0 since PostgreSQL 7.4, with 3.2 introduced in PostgreSQL 18), and the server forks a dedicated backend process per connection. Authentication methods include trust, password, md5, and the modern recommended scram-sha-256. The IANA reference field for 5432 is blank, so no RFC is tied to the assignment. Security-wise, exposed instances are brute-forced, and a misconfigured pg_hba.conf — particularly trust authentication on a public interface — yields unauthenticated access; CVE-2019-9193 describes the "COPY FROM/TO PROGRAM" capability that lets a superuser or suitably privileged role run arbitrary OS commands, which the PostgreSQL project characterizes as intended privileged functionality rather than a vulnerability, though it is widely used as a post-authentication RCE primitive. Containerized Postgres is frequently exposed through careless Docker port mappings. For an analyst, a public 5432 is a misconfiguration and a high-priority finding — check for default postgres credentials, trust auth, and superuser exposure.
- IANA assignment
postgresql— "PostgreSQL Database"; reference (blank — no RFC cited in IANA registry); assignee/contact blank in the registry row [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151)
- Prevalence
- common open database port (de-facto, nmap-services) [Well-established] — nmap-services file
- Related ports
- 5433 (common second instance); pooler ports (PgBouncer/Pgpool, site-defined)
Primary use
default PostgreSQL server listener
Other/unofficial uses
second instances commonly use 5433; poolers (PgBouncer, Pgpool) front 5432 [Well-established]
Security implications
brute-force; pg_hba.conf trust-auth misconfig → unauthenticated access; CVE-2019-9193 COPY FROM/TO PROGRAM (intended privileged functionality per the project; widely used post-auth RCE); SCRAM-SHA-256 + TLS recommended
Typically seen on
database servers, application backends (Django/Rails/Spring), Docker/Kubernetes containers, managed-DB endpoints
- Analyst note
- A public 5432 is a misconfiguration and high-priority finding; check for default
postgrescredentials,trustauth, and superuser exposure.
About port 5432/udp.
Port 5432/udp is registered with IANA as postgresql with the description "PostgreSQL Database," assignee Tom Lane, and a blank reference field. It is a dual registration: the same service name, description, and assignee are recorded identically for both 5432/tcp and 5432/udp, so the UDP row simply mirrors its TCP counterpart in the registry. In practice that UDP registration is a paper assignment only — PostgreSQL's client-server wire protocol operates exclusively over TCP, and no released version of the server has ever listened on UDP. The PostgreSQL frontend/backend protocol documentation describes a message-based, connection-oriented exchange that assumes a reliable TCP stream, and a well-known 2001 PostgreSQL mailing-list thread ("No UDP(5432) For You!") confirms the server does not bind UDP. For an analyst this matters because the security story for 5432 is entirely a TCP-side concern: exposed PostgreSQL instances on 5432/tcp are a recurring cloud-misconfiguration finding, regularly surfaced by Shodan and other scanners, where a weakly secured or unauthenticated database can leak sensitive records. UDP scanning on 5432, by contrast, produces no banner and no response because nothing listens there, so a UDP "hit" on this port is not a meaningful service indicator. The IANA registry cites no RFC for this entry and records no registration or modification date, so those fields stay blank here rather than being guessed.
- IANA assignment
postgresql— "PostgreSQL Database"; reference (blank — no RFC cited in IANA registry); assignee Tom Lane; dual-registered 5432/tcp + 5432/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 9794-9795; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5432)- Range class
- registered (1024–49151)
- Registration / modification date
- blank in the IANA registry (recorded as null, not guessed) [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5432
- Related ports
- 5432/tcp (the live PostgreSQL listener); other database services (3306 MySQL, 1433 MSSQL, 27017 MongoDB, 6379 Redis)
Primary use
PostgreSQL is a TCP-only database protocol; the 5432/udp assignment is a legacy IANA mirror of the TCP entry with no software that listens on UDP [Confirmed] — https://www.postgresql.org/docs/current/protocol.html ; https://www.postgresql.org/message-id/200103012233.f21MXqH27844@linda.lfix.co.uk
Other/unofficial uses
none — no PostgreSQL release binds UDP 5432; the row exists only as a registry dual-listing
Security implications
the exposure risk for 5432 is a TCP concern — publicly reachable PostgreSQL on 5432/tcp is a common cloud misconfiguration regularly surfaced by Shodan and scanners; weakly/unsecured instances can leak sensitive data. Nothing responds on 5432/udp, so UDP scanning here yields no banner and is not a documented attack vector
Typically seen on
hosts running PostgreSQL (on 5432/tcp); a responsive 5432/udp would be anomalous since no PostgreSQL service binds UDP
- Analyst note
- Treat 5432 exposure as a TCP-side database-security question. A UDP "hit" on 5432 is not a PostgreSQL service indicator; investigate the TCP listener instead.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| postgresql | TCP | PostgreSQL database server | 0.41% |
| postgresql | UDP | PostgreSQL Database | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.