Skip to main content

PostgreSQL JDBC Driver CVE-2026-42198

| EUVDEUVD-2026-26247 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-04-29 security-advisories@github.com GHSA-98qh-xjc8-98pq
Denial Of Service PostgreSQL Postgresql Jdbc Driver
7.5
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Availability-only impact (A:H) over the network; the attacker controls the server side of the SCRAM handshake so no client privileges or interaction are scored, though reaching a hostile endpoint is a real precondition.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Source Code Evidence Fetched
Jul 24, 2026 - 01:42 vuln.today
Analysis Generated
Jul 24, 2026 - 01:42 vuln.today
Patch released
May 01, 2026 - 12:51 nvd
Patch available
Patch available
Apr 29, 2026 - 17:01 EUVD
EUVD ID Assigned
Apr 29, 2026 - 16:22 euvd
EUVD-2026-26247
CVE Published
Apr 29, 2026 - 16:16 nvd
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 28 maven packages depend on org.postgresql:postgresql (27 direct, 1 indirect)

Ecosystem-wide dependent count for version 42.2.0.

DescriptionCVE.org

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

AnalysisAI

Client-side denial of service in the PostgreSQL JDBC Driver (pgjdbc) versions 42.2.0 through 42.7.10 lets a malicious, compromised, or attacker-controlled PostgreSQL server exhaust client CPU during SCRAM-SHA-256 authentication by advertising an extremely large PBKDF2 iteration count in the server-first-message. The affected Java client burns unbounded CPU inside PBKDF2 before authentication even fails, and because loginTimeout does not stop the worker thread, repeated or concurrent attempts can saturate cores and wedge connection pools. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and it is not in CISA KEV; this is an availability-only issue with no authentication bypass, privilege escalation, or password disclosure.

Technical ContextAI

The flaw lives in pgjdbc's implementation of SCRAM-SHA-256 (RFC 5802 / RFC 7677), the salted challenge-response mechanism PostgreSQL uses for password auth. During the handshake the server dictates the PBKDF2 iteration count in its server-first-message, and pgjdbc trusted that value without an upper bound, feeding it directly into the key-stretching loop. This is a textbook CWE-770 (Allocation of Resources Without Limits or Throttling) applied to CPU rather than memory: the cost of the cryptographic computation scales linearly with an attacker-supplied integer. Because PBKDF2 is deliberately expensive per iteration, a sufficiently large count converts a normal authentication step into a long-running, single-core-pinning computation. The affected artifact is the Maven package org.postgresql:postgresql (CPE cpe:2.3:a:postgresql:postgresql_jdbc_driver), embedded in countless Java/JVM applications, app servers, and connection-pool layers (HikariCP, etc.).

RemediationAI

Vendor-released patch: 42.7.11 - upgrade org.postgresql:postgresql to 42.7.11 or later (release: https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11). The fix adds a scramMaxIterations connection property (default 100,000) that caps the accepted iteration count before any PBKDF2 computation runs; after upgrading you can lower or raise this value to match your servers, with the trade-off that too low a cap could reject a legitimate high-security server configuration. If immediate upgrade is impossible, the effective compensating control is to ensure clients only reach trusted PostgreSQL servers: enforce sslmode=verify-full with a pinned/known CA so an on-path attacker cannot impersonate the server, refuse user-supplied or externally-configured JDBC URLs/hostnames, and remove untrusted proxies/tunnels from the connection path - the side effect is stricter TLS validation may break connections to servers with mismatched or self-signed certs. Do not rely on loginTimeout as a mitigation: the advisory states the worker thread keeps burning CPU after the timeout expires. Red Hat consumers should apply RHSA-2026:19098 / 22304 / 24348 / 25030 as applicable.

More in PostgreSQL

View all
CVE-2025-1094 HIGH POC
8.1 Feb 13

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2026-9586 CRITICAL POC
9.3 Jul 17

Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the

CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

Share

CVE-2026-42198 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy