CVE catalog

CVE-2026-42198

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
3.26% · Oct 25, 2026

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibpgjavasid42.7.14-1fixed
Debianlibpgjavaforky42.7.14-1fixed
Debianlibpgjavatrixie42.7.7-1vulnerable
Debianlibpgjavabookworm42.5.5-0+deb12u1vulnerable
CpelibpgjavaNot reportedNot reportedvulnerable
Cpepostgresql_jdbc_driverNot reported42.7.11fixed
Cpepostgresql_jdbc_driverNot reported42.7.11fixed
Opensusepostgresql-jdbctumbleweed42.7.11-1.1fixed
Susepostgresql-jdbclinux enterprise server 16.042.7.7-160000.3.1fixed
Susepostgresql-jdbclinux enterprise server for sap applications 16.042.7.7-160000.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibpgjavasourcesid42.7.11-1not yet assignedNot reportedNot reported
Debianlibpgjavasourceforky42.7.11-1not yet assignedNot reportedNot reported
Debianlibpgjavasourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibpgjavasourcebookworm(unfixed)not yet assignedNot reportedNot reported
Cpepostgresql_jdbc_drivercpeNot reported42.7.11Not reportedNot reportedNot reported
Cpepostgresql_jdbc_drivercpeNot reported42.7.11Not reportedNVD-CVE-2026-42198Not reported
Opensusepostgresql-jdbcrpmtumbleweed42.7.11-1.1Not reportedOPENSUSE-SU-2026:11001-1Not reported
Susepostgresql-jdbcrpmlinux enterprise server 16.042.7.7-160000.3.1Not reportedSUSE-SU-2026:22000-1Not reported
Susepostgresql-jdbcrpmlinux enterprise server for sap applications 16.042.7.7-160000.3.1Not reportedSUSE-SU-2026:22000-1Not reported

Notes

[trixie] libpgjava: Minor issue [bookworm] libpgjava: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libpostgresql-jdbc-java]Affected

    Source package: [libpgjava]

    Details (2)

    • 42.5.5-0+deb12u1 · all · bookworm

      Affected

      nvd · libpgjava · debian · bookworm; nvd · libpgjava · debian · 12

    • 42.5.5-0+deb12u1 · all · bookworm

      Affected

      nvd · libpgjava · debian · bookworm; nvd · libpgjava · debian · 12

  • [libpostgresql-jdbc-java-doc]Affected

    Source package: [libpgjava]

    Details (2)

    • 42.5.5-0+deb12u1 · all · bookworm

      Affected

      nvd · libpgjava · debian · bookworm; nvd · libpgjava · debian · 12

    • 42.5.5-0+deb12u1 · all · bookworm

      Affected

      nvd · libpgjava · debian · bookworm; nvd · libpgjava · debian · 12

[Debian 13 (Trixie)]

  • [libpostgresql-jdbc-java]Affected

    Source package: [libpgjava]

    Details (2)

    • 42.7.7-1 · all · trixie

      Affected

      nvd · libpgjava · debian · 13

    • 42.7.7-1 · all · trixie

      Affected

      nvd · libpgjava · debian · 13

[openSUSE Tumbleweed]

  • [postgresql-jdbc-javadoc]Unknown

    Source package: [postgresql-jdbc]

    Details (1)

    • 42.7.11-1.3 · noarch · tumbleweed

      Unknown · Fixed: 42.7.11-1.1

      Version impact unknown

      nvd · postgresql-jdbc · opensuse · tumbleweed

  • [postgresql-jdbc]Fixed

    Source package: [postgresql-jdbc]

    Details (1)

    • 42.7.11-1.3 · noarch · tumbleweed

      Fixed · Fixed: 42.7.11-1.1

      nvd · postgresql-jdbc · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]