Skip to main content

PostgreSQL CVE-2025-49146

| EUVDEUVD-2025-18118 HIGH
Improper Authentication (CWE-287)
2025-06-11 security-advisories@github.com GHSA-hq9p-pm7w-8p54
Authentication Bypass Java PostgreSQL Red Hat Postgresql Jdbc Driver Suse
8.2
CVSS 3.1 · GitHub Advisory
View

Vulnerability Assessment

Weakness
CWE
CWE-287
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK

2 techniques across 2 tactics: Defense Evasion, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS 8.2 (High) with AV:N/AC:L/PR:N/UI:N indicates a network-exploitable vulnerability requiring no privileges or user interaction, making it inherently high-risk. However, risk is moderated by configuration specificity: only deployments with explicit channelBinding=require setting are affected; the default is 'prefer', which is more lenient. The AC:L (Low Complexity) and AV:N (Network) components indicate MITM exploitation is straightforward for network-positioned attackers. Without disclosed EPSS or KEV data, this appears to be a moderate real-world priority: it requires (1) specific configuration, (2) network positioning, and (3) active MITM capability, but compensating controls are weak once an attacker is on the network path. Organizations running pgjdbc in security-sensitive contexts (financial, healthcare) with explicit channel binding requirements should treat this as critical; others should prioritize based on threat model. Patch availability (42.7.7) significantly reduces risk for responsive teams.
Exploit ScenarioDerived

An attacker on the network path between a Java application and PostgreSQL database (e.g., compromised router, BGP hijack, ARP spoofing in shared infrastructure) intercepts the TLS handshake. The application initiates a connection with channelBinding=require, expecting channel binding protection. The attacker responds with a ServerHello selecting a non-channel-binding auth method (e.g., password or MD5). Due to the pgjdbc bug, the driver fails to reject this downgrade and proceeds with password authentication. The attacker captures the password hash or plaintext and uses it to impersonate the application in future connections, gaining database access. Real-world impact: data exfiltration, modification, or denial of service depending on application database privileges. PoC would involve a rogue PostgreSQL server or proxy intercepting connections—GitHub likely has functional demonstrations given the specificity of the bug.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

The PostgreSQL JDBC driver (pgjdbc) versions 42.7.4 through 42.7.6 contain an authentication bypass vulnerability where channel binding validation is incorrectly disabled, allowing man-in-the-middle attackers to intercept connections that administrators configured to require channel binding protection. Affected users running pgjdbc with channel binding set to 'required' (a non-default but security-conscious configuration) are vulnerable to credential interception and session hijacking despite believing their connections are protected. The vulnerability is fixed in version 42.7.7.

RemediationAI

Immediate: Upgrade pgjdbc to version 42.7.7 or later. This version corrects the channel binding validation logic to properly enforce require semantics. Interim mitigations: (1) Change channelBinding connection property from 'require' to 'prefer' if acceptable for your security posture (reduces assurance but prevents downgrade), or (2) Set channelBinding=disable and enforce channel binding at the PostgreSQL server level with ssl_cert_auth or require SCRAM-SHA-256 exclusively. (3) Implement network segmentation to prevent MITM positioning (e.g., VPN, private networks, TLS certificate pinning in application code). For Maven/Gradle projects, update the dependency: org.postgresql:postgresql:42.7.7 or later. Verify no transitive dependencies lock older versions. Check vendor advisories at postgresql.org/about/news for additional context.

Affected VersionsENISA

pgjdbc 42.7.4, < 42.7.7

Affected Packages

maven org.postgresql:postgresql fix: 42.7.7
euvd pgjdbc_42_7_4 fix: 42.7.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The pgjdbc driver implements PostgreSQL's channel binding protocol extension (part of SCRAM-SHA-256 authentication), which cryptographically binds authentication to the TLS session to prevent MITM attacks. CWE-287 (Improper Authentication) indicates the root cause is a logic flaw in the channel binding validation routine—specifically, when channelBinding is set to 'require', the driver incorrectly allows fallback to authentication methods that do not support channel binding (password, MD5, GSS, SSPI). This defeats the entire purpose of requiring channel binding, as an attacker can force a downgrade to an unprotected auth method. The affected CPE is pgjdbc versions >=42.7.4 and <42.7.7. The vulnerability affects any Java application using org.postgresql:postgresql JDBC driver in this version range with channelBinding=require in connection properties.

Know when PostgreSQL gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Ubuntu MEDIUM
SUSE HIGH
Red Hat 8.2 HIGH

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

2
Patch released
Mar 14, 2026 - 21:09 nvd
Patch available
CVE Published
Jun 11, 2025 - 15:15 nvd
HIGH 8.2

DescriptionGitHub Advisory

pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.

Executive ViewAI

Why It Matters

Organizations using PostgreSQL JDBC Driver versions 42.7.4 through 42.7.6 with channel binding enabled face a man-in-the-middle attack risk that could compromise database authentication security. An attacker on the network could intercept and bypass security controls that applications rely on to protect database credentials and sensitive data in transit.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible, implement network segmentation to restrict database access to trusted application servers only, disable channel binding temporarily while assessing patch timelines, and monitor database connection logs for anomalous authentication patterns.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in PostgreSQL

View all
CVE-2025-1094 HIGH POC
8.1 Feb 13

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2026-9586 CRITICAL POC
9.3 Jul 17

Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the

CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

Ubuntu

Priority: Medium
libpgjava
Release Status Version
trusty needs-triage -
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
jammy needs-triage -
noble needs-triage -
upstream needs-triage -
plucky ignored end of life, was needs-triage
oracular ignored end of life, was needs-triage
questing needs-triage -

Debian

Bug #1107696
libpgjava
Release Status Fixed Version Urgency
bullseye not-affected - -
bullseye (security) fixed 42.2.15-1+deb11u2 -
bookworm not-affected - -
trixie fixed 42.7.7-1 -
forky, sid fixed 42.7.10-1 -
(unstable) fixed 42.7.7-1 -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Server 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
PATCH https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0 ADVISORY https://access.redhat.com/errata/RHSA-2025:10323 ADVISORY https://access.redhat.com/errata/RHSA-2025:13010 ADVISORY https://access.redhat.com/errata/RHSA-2025:13012 ADVISORY https://access.redhat.com/errata/RHSA-2025:13274 ADVISORY https://access.redhat.com/errata/RHSA-2025:16409 ADVISORY https://access.redhat.com/errata/RHSA-2025:9697 ADVISORY https://datatracker.ietf.org/doc/html/rfc5802 ADVISORY https://datatracker.ietf.org/doc/html/rfc7677 ADVISORY https://github.com/pgjdbc/pgjdbc ADVISORY https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-49146 ADVISORY https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy