Skip to main content

PostgreSQL JDBC Driver CVE-2026-42198

| EUVDEUVD-2026-26247 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-04-29 security-advisories@github.com GHSA-98qh-xjc8-98pq
Denial Of Service PostgreSQL Postgresql Jdbc Driver
7.5
CVSS 3.1 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Steer client to malicious PostgreSQL endpoint
  2. Delivery
    Server sends SCRAM server-first-message
  3. Exploit
    Specify huge PBKDF2 iteration count
  4. Execution
    Client computes PBKDF2 unbounded
  5. Impact
    Repeat/parallelize to exhaust CPU and wedge pool

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires ALL of: (1) the connection uses SCRAM-SHA-256 authentication; (2) the pgjdbc client (versions 42.2.0 to before 42.7.11) reaches a malicious, compromised, or attacker-controlled PostgreSQL endpoint; and (3) that endpoint returns a very large PBKDF2 iteration count in the SCRAM server-first-message. Realistic paths to condition (2) include applications that accept user/tenant-supplied connection strings, hostnames, or JDBC URLs (BI, reporting, analytics, ETL, low-code), connections through untrusted proxies/tunnels/bastions, redirection via DNS/service-discovery/Kubernetes/etc-hosts manipulation, or an on-path attacker when sslmode is weaker than verify-full. LIMITING factors: it is NOT exploitable against a client that only connects to a fixed, trusted server with strong identity verification; impact is availability only (no data or integrity impact); and severity is amplified when the app uses retries, many parallel connection attempts, or assumes loginTimeout stops the work.
Impact

The signals are consistent and point to a real-but-narrow issue rather than a widespread emergency. CVSS 3.1 is 7.5 driven entirely by A:H (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) - high because it is network-reachable and unauthenticated in scoring terms, but the impact is availability only. That network/unauthenticated framing is misleading in isolation: the 'attacker' is the PostgreSQL server itself, so exploitation requires the client to connect to an attacker-controlled or compromised endpoint, which is a genuine precondition the base vector does not capture. EPSS is 0.02% (7th percentile) and SSVC records Exploitation: none, Automatable: yes, Technical Impact: partial - the 'automatable: yes' reflects that once a client can be steered to a hostile server the attack scales trivially. There is no KEV listing and no known POC. Net: prioritize patching where clients connect to untrusted, user-supplied, multi-tenant, or proxied database endpoints; deprioritize where clients only ever reach a fixed, trusted, fully-verified server.
Exploit ScenarioDerived

A BI/analytics or ETL platform lets tenants supply their own PostgreSQL connection details; an attacker points the shared client host at a PostgreSQL server they control that responds to SCRAM-SHA-256 with a multi-billion PBKDF2 iteration count. Each connection attempt pins a CPU core inside PBKDF2, and by opening many concurrent connections the attacker saturates the host and wedges its connection pool, denying service to other tenants. No public POC is identified, but the attack is straightforward to build given control of the server side of the handshake.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Client-side denial of service in the PostgreSQL JDBC Driver (pgjdbc) versions 42.2.0 through 42.7.10 lets a malicious, compromised, or attacker-controlled PostgreSQL server exhaust client CPU during SCRAM-SHA-256 authentication by advertising an extremely large PBKDF2 iteration count in the server-first-message. The affected Java client burns unbounded CPU inside PBKDF2 before authentication even fails, and because loginTimeout does not stop the worker thread, repeated or concurrent attempts can saturate cores and wedge connection pools. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and it is not in CISA KEV; this is an availability-only issue with no authentication bypass, privilege escalation, or password disclosure.

RemediationAI

Vendor-released patch: 42.7.11 - upgrade org.postgresql:postgresql to 42.7.11 or later (release: https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11). The fix adds a scramMaxIterations connection property (default 100,000) that caps the accepted iteration count before any PBKDF2 computation runs; after upgrading you can lower or raise this value to match your servers, with the trade-off that too low a cap could reject a legitimate high-security server configuration. If immediate upgrade is impossible, the effective compensating control is to ensure clients only reach trusted PostgreSQL servers: enforce sslmode=verify-full with a pinned/known CA so an on-path attacker cannot impersonate the server, refuse user-supplied or externally-configured JDBC URLs/hostnames, and remove untrusted proxies/tunnels from the connection path - the side effect is stricter TLS validation may break connections to servers with mismatched or self-signed certs. Do not rely on loginTimeout as a mitigation: the advisory states the worker thread keeps burning CPU after the timeout expires. Red Hat consumers should apply RHSA-2026:19098 / 22304 / 24348 / 25030 as applicable.

Affected VersionsENISA

pgjdbc 42.2.0, < 42.7.11

Affected Packages

maven org.postgresql:postgresql fix: 42.7.11
euvd pgjdbc_42_2_0 fix: 42.7.11

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in pgjdbc's implementation of SCRAM-SHA-256 (RFC 5802 / RFC 7677), the salted challenge-response mechanism PostgreSQL uses for password auth. During the handshake the server dictates the PBKDF2 iteration count in its server-first-message, and pgjdbc trusted that value without an upper bound, feeding it directly into the key-stretching loop. This is a textbook CWE-770 (Allocation of Resources Without Limits or Throttling) applied to CPU rather than memory: the cost of the cryptographic computation scales linearly with an attacker-supplied integer. Because PBKDF2 is deliberately expensive per iteration, a sufficiently large count converts a normal authentication step into a long-running, single-core-pinning computation. The affected artifact is the Maven package org.postgresql:postgresql (CPE cpe:2.3:a:postgresql:postgresql_jdbc_driver), embedded in countless Java/JVM applications, app servers, and connection-pool layers (HikariCP, etc.).

Know when PostgreSQL gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Availability-only impact (A:H) over the network; the attacker controls the server side of the SCRAM handshake so no client privileges or interaction are scored, though reaching a hostile endpoint is a real precondition.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Patch released
May 01, 2026 - 12:51 nvd
Patch available
Patch available
Apr 29, 2026 - 17:01 EUVD
CVE Published
Apr 29, 2026 - 16:16 nvd
HIGH 7.5

DescriptionCVE.org

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 28 maven packages depend on org.postgresql:postgresql (27 direct, 1 indirect)

Ecosystem-wide dependent count for version 42.2.0.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Prevalence
High
the standard JDBC driver for PostgreSQL in most Java enterprise deployments
Threat Intel
1
1 source
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in PostgreSQL

View all
CVE-2025-1094 HIGH POC
8.1 Feb 13

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2026-9586 CRITICAL POC
9.3 Jul 17

Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the

CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42198 ADVISORY https://vuldb.com/vuln/360172 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-42198 REF https://access.redhat.com/errata/RHSA-2026:19098 REF https://access.redhat.com/errata/RHSA-2026:22304 REF https://access.redhat.com/errata/RHSA-2026:24348 REF https://access.redhat.com/errata/RHSA-2026:25030 REF https://access.redhat.com/errata/RHSA-2026:52928 REF https://access.redhat.com/errata/RHSA-2026:52929 REF https://access.redhat.com/errata/RHSA-2026:52930 REF https://access.redhat.com/errata/RHSA-2026:52978 REF https://access.redhat.com/errata/RHSA-2026:54532 REF https://access.redhat.com/errata/RHSA-2026:59277 REF https://access.redhat.com/errata/RHSA-2026:59278 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/errata/RHSA-2026:66545 REF https://access.redhat.com/security/cve/CVE-2026-42198 REF https://bugzilla.redhat.com/show_bug.cgi?id=2463857 REF https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11 REF https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42198.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy