lahma · Oct 2, 2026 · Oct 2, 2026
@@ -245,6 +245,15 @@ internal bool PostgresCancellationPerformed
     internal bool UserCancellationRequested => _userCancellationRequested;
     internal CancellationToken UserCancellationToken { get; set; }
     internal bool AttemptPostgresCancellation { get; private set; }
+
+    /// <summary>
+    /// Whether a read that has just timed out should send a PostgreSQL cancel request: not when one was already sent,
+    /// and not when the user's cancellation was deferred because prepended responses are still outstanding - then the
+    /// read deadline is the hard-cancellation deadline set by <see cref="PerformImmediateUserCancellation" />.
+    /// </summary>
+    internal bool ShouldAttemptPostgresCancellation
+        => AttemptPostgresCancellation && !PostgresCancellationPerformed
+           && !(UserCancellationRequested && !ReadingPrependedMessagesMRE.IsSet);
     static readonly TimeSpan _cancelImmediatelyTimeout = TimeSpan.Zero;
 
     static readonly SslApplicationProtocol _alpnProtocol = new("postgresql");
@@ -1933,7 +1942,22 @@ internal void PerformImmediateUserCancellation()
             // We don't wait indefinitely to avoid deadlocks from synchronous CancellationToken.Register
             // See #5032
             if (!ReadingPrependedMessagesMRE.Wait(0))
+            {
+                // We can neither send a PostgreSQL cancellation now (it could cancel a prepended query, #4906) nor
+                // block until the prepended responses arrive (#5032). PerformDelayedUserCancellation runs once they
+                // have been read; until then, bound the wait by the cancellation timeout, so a server that never
+                // answers doesn't leave the user's token without effect until Command Timeout.
+                // A synchronous read already in progress isn't interrupted (#5070), but the reads after it are bounded.
+                // For -1 we still use a positive timeout, since a zero Socket.ReceiveTimeout means no timeout at all.
+                var cancellationTimeout = Settings.CancellationTimeout;
+                if (cancellationTimeout != 0)
+                {
+                    var timeout = Math.Max(cancellationTimeout, 1);
+                    ReadBuffer.Timeout = TimeSpan.FromMilliseconds(timeout);
+                    ReadBuffer.Cts.CancelAfter(timeout);
+                }
                 return;
+            }
 
             PerformUserCancellationUnsynchronized();
         }

@@ -162,7 +162,7 @@ int ReadWithTimeout(Span<byte> buffer)
                     // If we should attempt PostgreSQL cancellation, do it the first time we get a timeout.
                     // TODO: As an optimization, we can still attempt to send a cancellation request, but after
                     // that immediately break the connection
-                    if (connector is { AttemptPostgresCancellation: true, PostgresCancellationPerformed: false }
+                    if (connector is { ShouldAttemptPostgresCancellation: true }
                         && connector.PerformPostgresCancellation())
                     {
                         // Note that if the cancellation timeout is negative, we flow down and break the
@@ -220,7 +220,7 @@ async ValueTask<int> ReadWithTimeoutAsync(Memory<byte> buffer, CancellationToken
                     // If we should attempt PostgreSQL cancellation, do it the first time we get a timeout.
                     // TODO: As an optimization, we can still attempt to send a cancellation request, but after
                     // that immediately break the connection
-                    if (connector is { AttemptPostgresCancellation: true, PostgresCancellationPerformed: false } &&
+                    if (connector is { ShouldAttemptPostgresCancellation: true } &&
                         connector.PerformPostgresCancellation())
                     {
                         // Note that if the cancellation timeout is negative, we flow down and break the
@@ -346,7 +346,7 @@ static async ValueTask EnsureLong(
                         // If we should attempt PostgreSQL cancellation, do it the first time we get a timeout.
                         // TODO: As an optimization, we can still attempt to send a cancellation request, but after
                         // that immediately break the connection
-                        if (connector is { AttemptPostgresCancellation: true, PostgresCancellationPerformed: false } &&
+                        if (connector is { ShouldAttemptPostgresCancellation: true } &&
                             connector.PerformPostgresCancellation())
                         {
                             // Note that if the cancellation timeout is negative, we flow down and break the

@@ -370,6 +370,83 @@ await server
         Assert.That(conn.FullState, Is.EqualTo(ConnectionState.Open));
     }
 
+    [Test, Description("Cancellation requested while the server never answers a prepended query breaks the connection after Cancellation Timeout, not Command Timeout")]
+    public async Task Cancel_async_with_prepended_query_server_unresponsive()
+    {
+        await using var postmasterMock = PgPostmasterMock.Start(ConnectionString);
+        var csb = new NpgsqlConnectionStringBuilder(postmasterMock.ConnectionString)
+        {
+            NoResetOnClose = false,
+            CommandTimeout = 30,
+            CancellationTimeout = 1000
+        };
+        await using var dataSource = CreateDataSource(csb.ConnectionString);
+        await using var conn = await dataSource.OpenConnectionAsync();
+        // Reopen the connection so DISCARD ALL is prepended to the next query
+        await conn.CloseAsync();
+        await conn.OpenAsync();
+
+        using var cts = new CancellationTokenSource();
+        var queryTask = conn.ExecuteNonQueryAsync("SELECT 1", cancellationToken: cts.Token);
+
+        var server = await postmasterMock.WaitForServerConnection();
+        await server.ExpectSimpleQuery("DISCARD ALL");
+        await server.ExpectExtendedQuery();
+
+        // The server never answers
+        var sw = System.Diagnostics.Stopwatch.StartNew();
+        cts.Cancel();
+        var exception = Assert.ThrowsAsync<OperationCanceledException>(async () => await queryTask)!;
+        Assert.That(sw.Elapsed, Is.LessThan(TimeSpan.FromSeconds(10)));
+        Assert.That(exception.CancellationToken, Is.EqualTo(cts.Token));
+        Assert.That(conn.FullState, Is.EqualTo(ConnectionState.Broken));
+
+        // No cancel request may be sent while a prepended query is outstanding (#4906)
+        var cancellationRequestTask = postmasterMock.WaitForCancellationRequest().AsTask();
+        await Task.Delay(500);
+        Assert.That(cancellationRequestTask.IsCompleted, Is.False);
+    }
+
+    [Test, Description("Cancel() while the server stalls in the middle of a prepended query's response breaks the connection after Cancellation Timeout, not Command Timeout")]
+    public async Task Cancel_sync_with_prepended_query_server_unresponsive([Values(1000, -1)] int cancellationTimeout)
+    {
+        await using var postmasterMock = PgPostmasterMock.Start(ConnectionString);
+        var csb = new NpgsqlConnectionStringBuilder(postmasterMock.ConnectionString)
+        {
+            NoResetOnClose = false,
+            CommandTimeout = 30,
+            CancellationTimeout = cancellationTimeout
+        };
+        await using var dataSource = CreateDataSource(csb.ConnectionString);
+        await using var conn = dataSource.OpenConnection();
+        // Reopen the connection so DISCARD ALL is prepended to the next query
+        conn.Close();
+        conn.Open();
+
+        await using var cmd = new NpgsqlCommand("SELECT 1", conn);
+        var queryTask = Task.Run(() => cmd.ExecuteNonQuery());
+
+        var server = await postmasterMock.WaitForServerConnection();
+        await server.ExpectSimpleQuery("DISCARD ALL");
+        await server.ExpectExtendedQuery();
+        cmd.WaitUntilCommandIsInProgress();
+
+        var sw = System.Diagnostics.Stopwatch.StartNew();
+        cmd.Cancel();
+        // A synchronous read already in progress isn't interrupted (#5070); the server sends part of the DISCARD ALL
+        // response to end it, and then never answers again, so the next read is the one bounded by Cancellation Timeout
+        await server.WriteCommandComplete().FlushAsync();
+
+        Assert.ThrowsAsync<OperationCanceledException>(async () => await queryTask);
+        Assert.That(sw.Elapsed, Is.LessThan(TimeSpan.FromSeconds(10)));
+        Assert.That(conn.FullState, Is.EqualTo(ConnectionState.Broken));
+
+        // No cancel request may be sent while a prepended query is outstanding (#4906)
+        var cancellationRequestTask = postmasterMock.WaitForCancellationRequest().AsTask();
+        await Task.Delay(500);
+        Assert.That(cancellationRequestTask.IsCompleted, Is.False);
+    }
+
     [Test, Description("Cancels an async query with the cancellation token, with unsuccessful PG cancellation (socket break)")]
     public async Task Cancel_async_hard()
     {