CVE-2026-107313
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos. The stored value then holds bytes of the messages the driver sent just before it on the same connection, such as the statement's SQL text, its other parameters, and earlier rows of the same batch, instead of the bytes the application supplied. Values at least as long as the buffer are affected when the driver writes them from a byte array. Versions 42.7.3 and earlier are not affected, and 42.7.6 fixes the problem.
Risk Assessment
An attacker could cause leakage of sensitive data from earlier messages on the same connection, such as SQL query text or other parameters, potentially leading to information disclosure. The risk only occurs when GSS encryption is enabled (gssEncMode=prefer or require).
Recommendation
Update the PostgreSQL JDBC Driver to version 42.7.6. If updating is not possible, consider setting gssEncMode=allow or disable to avoid the issue.
Related vulnerabilities
- CVE-2026-115905Critical
Through 9.0.4, the Rust zip library's ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata. A crafted archive can appear benign to a component inspecting the central directory but cause a streaming extractor to write a different attacker-selected path and content.
- CVE-2026-112346Critical
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability. The DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default.
- CVE-2026-93328Critical
Path Traversal and Missing Authorization in the cloud-storage source of Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
- CVE-2026-77055Critical
The boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0.
- CVE-2026-65184Critical
The root-privileged 'wsserver' terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to system() and popen() without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
- CVE-2026-59107Critical
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.
- CVE-2026-59106Critical
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.
- CVE-2026-116485Critical
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
- CVE-2026-116214Critical
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
- CVE-2026-115693Critical
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration, which accepts any certificate in the peer chain whose public key matches a root in the bundled certifi store, even when the connection is pinned to a private CA. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney from 1.24.0 before 4.9.0.
Original NVD description (English source)
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos. The stored value then holds bytes of the messages the driver sent just before it on the same connection, such as the statement's SQL text, its other parameters, and earlier rows of the same batch, instead of the bytes the application supplied. Values at least as long as the buffer are affected when the driver writes them from a byte array: bind parameters set with setString, setBytes, or a ByteStreamWriter, CopyIn.writeToCopy, and LargeObject.write. Most such writes fail with an ArrayIndexOutOfBoundsException instead. The default, gssEncMode=allow, does not start GSS encryption, and connections without GSS encryption are not affected. Versions 42.7.3 and earlier are not affected, and 42.7.6 fixes the problem.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS