Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
PostgreSQL JDBC Driver Denial of Service Risk
published 5 months ago
Summary
A malicious server can cause a Java program connecting to PostgreSQL to waste CPU resources, potentially leading to slow performance or even crashes. This issue affects Java programs using PostgreSQL databases, particularly those with high traffic or large connection pools. Update to the latest version of the PostgreSQL JDBC Driver to fix this issue.
What to do
- Update openeuler postgresql-jdbc to version 42.4.1-4.oe2003sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:20.03-LTS-SP4 | openeuler | postgresql-jdbc |
< 42.4.1-4.oe2003sp4 Fix: upgrade to 42.4.1-4.oe2003sp4
|
Original advisory text
postgresql-jdbc security update
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.
Security Fix(es):
pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)
Security Fix(es):
pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42198 Vendor Advisory
Timeline
Published22 May 2026
Updated22 May 2026
First seen22 May 2026
Sources
OESA-2026-2445 · OSV
Track software like this
Free during beta