From c8c7b4e9b7fd7bd2aab206c4359bcc213294fb39 Mon Sep 17 00:00:00 2001
From: Nikita Kazmin <vonzshik@gmail.com>
Date: Thu, 22 Jan 2026 16:37:01 +0300
Subject: [PATCH] Improve fallback handling for GSS session encryption when
 native library is missing

---
 src/Npgsql/Internal/NpgsqlConnector.cs | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/Npgsql/Internal/NpgsqlConnector.cs b/src/Npgsql/Internal/NpgsqlConnector.cs
index 4c18372699..dc864904f5 100644
--- a/src/Npgsql/Internal/NpgsqlConnector.cs
+++ b/src/Npgsql/Internal/NpgsqlConnector.cs
@@ -676,7 +676,22 @@ internal async ValueTask<GssEncryptionResult> GSSEncrypt(bool async, bool isRequ
 
         try
         {
-            var data = authentication.GetOutgoingBlob(ReadOnlySpan<byte>.Empty, out var statusCode)!;
+            byte[]? data;
+            NegotiateAuthenticationStatusCode statusCode;
+
+            try
+            {
+                data = authentication.GetOutgoingBlob(ReadOnlySpan<byte>.Empty, out statusCode)!;
+            }
+            catch (TypeInitializationException)
+            {
+                // On UNIX .NET throws TypeInitializationException if it's unable to load the native library
+                if (isRequired)
+                    throw new NpgsqlException("Unable to load native library to negotiate GSS encryption");
+
+                return GssEncryptionResult.GetCredentialFailure;
+            }
+
             if (statusCode != NegotiateAuthenticationStatusCode.ContinueNeeded)
             {
                 // Unable to retrieve credentials