postgresql-server -- Role pg_cancel_backend can signal certain superuser processes

PostgreSQL Project reports:

    Documentation says the pg_cancel_backend role cannot
    signal "a backend owned by a superuser". On the
    contrary, it can signal background workers, including
    the logical replication launcher. It can signal
    autovacuum workers and the autovacuum launcher.
    Signaling autovacuum workers and those two launchers
    provides no meaningful exploit, so exploiting this
    vulnerability requires a non-core extension with a
    less-resilient background worker. For example, a
    non-core background worker that does not auto-restart
    would experience a denial of service with respect to
    that particular background worker.