CVE-2026-42198

HighCVSS 7.5

Published: 29/04/2026(UTC)Updated: 11/09/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.26%

88th percentile - higher than 88% of all known CVEs

Summary

The pgjdbc PostgreSQL JDBC driver versions 42.2.0 through 42.7.10 is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can force the driver to perform PBKDF2 with an extremely large iteration count, causing excessive CPU consumption and potentially wedging connection pools. The loginTimeout parameter did not fully mitigate the issue, as the worker thread continued computation even after the timeout expired.

Risk Assessment

An attacker can remotely overload the application server by exhausting CPU resources, preventing new database connections and causing service disruption.

Recommendation

Immediately upgrade pgjdbc to version 42.7.11 or later. If an upgrade is not possible, consider restricting trusted PostgreSQL servers or implementing additional execution time limits.

Other vulnerabilities in pgjdbc

CVE-2026-54291Medium
The pgjdbc PostgreSQL JDBC driver versions 42.7.4 through 42.7.11 allow silent downgrade of SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256. A man-in-the-middle attacker can exploit a certificate lacking the proper channel binding hash to trigger the downgrade and bypass protection.

Original NVD description (English source)

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.