Skip to main content

pgjdbc CVE-2026-54291

| EUVDEUVD-2026-41903 HIGH
Not Failing Securely ('Failing Open') (CWE-636)
2026-07-06 GitHub_M GHSA-j92g-9f8w-j867
Information Disclosure PostgreSQL Red Hat Suse Pgjdbc
8.2
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

Network vector but AC:H because a pre-existing TLS MITM position and a specific certificate signature algorithm are required; impact is loss of authentication integrity (I:H) with no direct confidentiality or availability loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 06, 2026 - 20:02 EUVD
Analysis Generated
Jul 06, 2026 - 19:39 vuln.today
CVE Published
Jul 06, 2026 - 18:55 cve.org
HIGH 8.2

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1,136 maven packages depend on org.postgresql:postgresql (416 direct, 721 indirect)

Ecosystem-wide dependent count for version 42.7.4.

DescriptionCVE.org

pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.

Articles & Coverage 1

News 3 New PostgreSQL Vulnerabilities - 1 Critical, 2 High Severity Jul 07, 2026

AnalysisAI

Channel-binding downgrade in the pgjdbc PostgreSQL JDBC Driver (releases 42.7.4 through 42.7.11) lets an active man-in-the-middle silently strip SCRAM-SHA-256-PLUS channel binding down to plain SCRAM-SHA-256 even when the client explicitly set channelBinding=require, defeating the exact protection that setting promises. The flaw stems from the bundled com.ongres.scram:scram-client returning an empty binding for certificates whose signature algorithm lacks a tls-server-end-point hash, combined with pgJDBC's ScramAuthenticator failing to reject that empty binding. No public exploit identified at time of analysis and it is not listed in CISA KEV; it is fixed in 42.7.12.

Technical ContextAI

pgjdbc is the official Java (JDBC) driver used by Java applications to connect to PostgreSQL. Authentication uses SCRAM (Salted Challenge Response Authentication Mechanism); the '-PLUS' variant (SCRAM-SHA-256-PLUS) binds the authentication exchange to the underlying TLS channel via the tls-server-end-point mechanism, which hashes the server certificate so a proxy cannot sit in the middle. The root cause is CWE-636 (Not Failing Securely / 'Failing Open'): when a certificate's signature algorithm has no defined channel-binding hash, the bundled com.ongres.scram:scram-client returns an empty byte array instead of raising an error, and pgJDBC's ScramAuthenticator only verifies that the server advertised a PLUS mechanism - it never rejects the empty binding data nor confirms that the mechanism actually negotiated used channel binding. The CPE cpe:2.3:a:pgjdbc:pgjdbc:*:*:*:*:*:*:*:* confirms the affected component is the pgjdbc driver itself.

RemediationAI

Vendor-released patch: 42.7.12 - upgrade the pgjdbc driver dependency to 42.7.12 or later, which also pulls the corrected com.ongres.scram:scram-client (release 3.3) so empty channel-binding data is rejected rather than accepted. The fix commit is https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99 and details are in advisory https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867. If you cannot upgrade immediately, reduce reliance on the client-side channel-binding check by ensuring PostgreSQL servers present certificates whose signature algorithms have a defined tls-server-end-point hash (avoid algorithms that yield an empty binding), and pin/validate the server certificate at the application or network layer so a MITM cannot substitute a certificate; additionally restrict the network path between application and database (private subnets, mutual TLS, strict certificate verification with sslmode=verify-full) to remove the attacker's MITM foothold - the trade-off is that these controls harden the transport but do not restore the specific channel-binding guarantee, so upgrading remains the only complete fix.

More in PostgreSQL

View all
CVE-2025-1094 HIGH POC
8.1 Feb 13

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2026-9586 CRITICAL POC
9.3 Jul 17

Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the

CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al

Same weakness CWE-636 – Not Failing Securely ('Failing Open')

View all
CVE-2026-22034 CRITICAL POC
9.8
CVE-2024-3729 CRITICAL
9.8
CVE-2026-69306 HIGH
8.2
CVE-2026-81379 HIGH
8.2
CVE-2026-40525 CRITICAL
9.1
CVE-2026-18329 HIGH
8.8
CVE-2024-43532 HIGH
8.8
CVE-2021-1578 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

Share

CVE-2026-54291 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy