Every CVE Search/ Get API key

CVE-2026-42198

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

7.5 HighFix available

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

3.26%Up 3.2 points since Apr 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Record
CVE-2026-42198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770, CWE-770
Updated
2026-11-02
EUVDEUVD-2026-26247 7.5

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Record
EUVD-2026-26247
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-98qh-xjc8-98pq 7.5

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

Summary

pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication.

Impact

A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools.

In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation.

This issue affects availability. It does not provide authentication bypass, privilege escalation, or direct password disclosure.

A user is vulnerable when all of the following are true:

  1. The connection uses SCRAM-SHA-256 authentication.
  2. The client reaches a malicious, compromised, or attacker-controlled PostgreSQL endpoint.
  3. That endpoint sends a very large SCRAM PBKDF2 iteration count in the server-first-message.

In practice, that can happen in these situations:

  • the application lets end users or tenants supply their own database connection details (as in many BI, reporting, analytics, ETL, and low-code platforms), so a user can point the shared client host at a server they control
  • the application accepts connection strings, hostnames, or JDBC URLs from user input, configuration uploaded by users, or other untrusted sources
  • the application is configured to connect to a PostgreSQL server that is itself malicious or later becomes compromised
  • the application connects through an untrusted proxy, relay, tunnel, bastion, or connection-pooling service that can act as the PostgreSQL server
  • an attacker can redirect the client to a fake PostgreSQL endpoint by manipulating DNS, service discovery, Kubernetes service resolution, /etc/hosts, environment variables, or similar indirection
  • an active network attacker on the path can impersonate the server because the connection does not strongly verify server identity (for example, sslmode lower than verify-full, or trusting a CA that signs hosts outside the operator's control)

The issue is more damaging when the application uses connection retries, many parallel connection attempts, or loginTimeout and assumes the timeout fully stops the work.

Patches

The patch introduces a new connection property, scramMaxIterations, with a default of 100K. The client now rejects SCRAM server messages that advertise more PBKDF2 iterations than the configured cap before starting the PBKDF2 computation begins.

Workarounds

Until a patched version of pgjdbc is deployed, the following measures reduce exposure:

  1. Only connect to trusted PostgreSQL servers whose identity is verified.
    Connect only to trusted PostgreSQL servers, and verify server identity with TLS using sslmode=verify-full and a trusted CA. TLS without certificate and hostname verification is not sufficient as an active network attacker can still impersonate the server.

  2. Do not rely on loginTimeout as a complete mitigation on unpatched versions.
    On affected versions, loginTimeout can stop the waiting caller while the worker thread continues spending CPU.

  3. Avoid SCRAM on untrusted or interceptable connection paths.
    For those paths, use an authentication method that does not let the server choose a SCRAM PBKDF2 iteration count.

  4. Reduce blast radius operationally.
    Limit parallel connection attempts, add retry backoff, isolate connection establishment in a separate worker or process when possible, and apply CPU or container limits where appropriate.

  5. On trusted servers you control, keep SCRAM iteration counts at ordinary values.
    This does not defend against an attacker-controlled server, but it avoids…

Record
GHSA-98qh-xjc8-98pq
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
NVD 7.5

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Record
CVE-2026-42198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSV 7.5

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Record
CVE-2026-42198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2026-42198 7.5

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Record
DEBIAN-CVE-2026-42198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 34 moreShow less
OSVGHSA-98qh-xjc8-98pq 7.5

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

Summary

pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication.

Impact

A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools.

In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation.

This issue affects availability. It does not provide authentication bypass, privilege escalation, or direct password disclosure.

A user is vulnerable when all of the following are true:

  1. The connection uses SCRAM-SHA-256 authentication.
  2. The client reaches a malicious, compromised, or attacker-controlled PostgreSQL endpoint.
  3. That endpoint sends a very large SCRAM PBKDF2 iteration count in the server-first-message.

In practice, that can happen in these situations:

  • the application lets end users or tenants supply their own database connection details (as in many BI, reporting, analytics, ETL, and low-code platforms), so a user can point the shared client host at a server they control
  • the application accepts connection strings, hostnames, or JDBC URLs from user input, configuration uploaded by users, or other untrusted sources
  • the application is configured to connect to a PostgreSQL server that is itself malicious or later becomes compromised
  • the application connects through an untrusted proxy, relay, tunnel, bastion, or connection-pooling service that can act as the PostgreSQL server
  • an attacker can redirect the client to a fake PostgreSQL endpoint by manipulating DNS, service discovery, Kubernetes service resolution, /etc/hosts, environment variables, or similar indirection
  • an active network attacker on the path can impersonate the server because the connection does not strongly verify server identity (for example, sslmode lower than verify-full, or trusting a CA that signs hosts outside the operator's control)

The issue is more damaging when the application uses connection retries, many parallel connection attempts, or loginTimeout and assumes the timeout fully stops the work.

Patches

The patch introduces a new connection property, scramMaxIterations, with a default of 100K. The client now rejects SCRAM server messages that advertise more PBKDF2 iterations than the configured cap before starting the PBKDF2 computation begins.

Workarounds

Until a patched version of pgjdbc is deployed, the following measures reduce exposure:

  1. Only connect to trusted PostgreSQL servers whose identity is verified.
    Connect only to trusted PostgreSQL servers, and verify server identity with TLS using sslmode=verify-full and a trusted CA. TLS without certificate and hostname verification is not sufficient as an active network attacker can still impersonate the server.

  2. Do not rely on loginTimeout as a complete mitigation on unpatched versions.
    On affected versions, loginTimeout can stop the waiting caller while the worker thread continues spending CPU.

  3. Avoid SCRAM on untrusted or interceptable connection paths.
    For those paths, use an authentication method that does not let the server choose a SCRAM PBKDF2 iteration count.

  4. Reduce blast radius operationally.
    Limit parallel connection attempts, add retry backoff, isolate connection establishment in a separate worker or process when possible, and apply CPU or container limits where appropriate.

  5. On trusted servers you control, keep SCRAM iteration counts at ordinary values.
    This does not defend against an attacker-controlled server, but it avoids…

Record
GHSA-98qh-xjc8-98pq
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVOESA-2026-2443 7.5

postgresql-jdbc security update

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.

Security Fix(es):

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)

Record
OESA-2026-2443
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2444 7.5

postgresql-jdbc security update

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.

Security Fix(es):

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)

Record
OESA-2026-2444
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2445 7.5

postgresql-jdbc security update

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.

Security Fix(es):

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)

Record
OESA-2026-2445
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2446 7.5

postgresql-jdbc security update

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.

Security Fix(es):

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)

Record
OESA-2026-2446
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2501 7.5

postgresql-jdbc security update

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.

Security Fix(es):

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)

Record
OESA-2026-2501
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHLW-2026-5920e9c5f3ada010 7.5

Lightwell Security Advisory: postgresql 42.7.3.rhlw-00001

Red Hat Lightwell has released org.postgresql:postgresql 42.7.3.rhlw-00001 with a backported security fix.

CVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

This patched artifact is a drop-in replacement for org.postgresql:postgresql 42.7.3 from Maven Central.

Record
RHLW-2026-5920e9c5f3ada010
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHLW-2026-b44d1f7dac7a0d3d 7.1

Lightwell Security Advisory: postgresql 42.3.3.rhlw-00006

Red Hat Lightwell has released org.postgresql:postgresql 42.3.3.rhlw-00006 with backported fixes for CVE-2022-31197, CVE-2022-41946, CVE-2024-1597, and CVE-2026-42198.

CVE-2022-31197: SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

CVE-2022-41946: TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc

CVE-2024-1597: pgjdbc SQL Injection via line comment generation

CVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

This patched artifact is a drop-in replacement for org.postgresql:postgresql 42.3.3 from Maven Central.

Record
RHLW-2026-b44d1f7dac7a0d3d
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:22304 7.5

Red Hat Security Advisory: postgresql-jdbc security update

Record
RHSA-2026:22304
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:24348 7.5

Red Hat Security Advisory: postgresql-jdbc security update

Record
RHSA-2026:24348
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25030 7.5

Red Hat Security Advisory: postgresql-jdbc security update

Record
RHSA-2026:25030
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:52928 7.5

Red Hat Security Advisory: postgresql-jdbc security update

Record
RHSA-2026:52928
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:52929 7.5

Red Hat Security Advisory: postgresql-jdbc security update

Record
RHSA-2026:52929
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:52930 7.5

Red Hat Security Advisory: postgresql-jdbc security update

Record
RHSA-2026:52930
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:52978 7.5

Red Hat Security Advisory: postgresql-jdbc security update

Record
RHSA-2026:52978
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:54532 7.5

Red Hat Security Advisory: postgresql-jdbc security update

Record
RHSA-2026:54532
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:59277 7.5

Red Hat Security Advisory: postgresql-jdbc security update

Record
RHSA-2026:59277
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:59278 7.5

Red Hat Security Advisory: postgresql-jdbc security update

Record
RHSA-2026:59278
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:22304 7.5

Important: postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

  • jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:22304
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:24348 7.5

Important: postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

  • jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:24348
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:25030 7.5

Important: postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

  • jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25030
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-42198 7.5

CVE-2026-42198 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2026-42198 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2026-42198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-42198 7.5

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Record
UBUNTU-CVE-2026-42198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-04
OSVALSA-2026:22304 No score

Important: postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

  • jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:22304
Updated
2026-11-02
OSVALSA-2026:24348 No score

Important: postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

  • jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:24348
Updated
2026-11-02
OSVALSA-2026:25030 No score

Important: postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

  • jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25030
Updated
2026-11-02
OSVBIT-postgresql-jdbc-driver-2026-42198 No score

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Record
BIT-postgresql-jdbc-driver-2026-42198
Updated
2026-11-02
OSVCLSA-2026-1781092532 No score

postgresql-jdbc: Fix of CVE-2026-42198

  • CVE-2026-42198: fix unbounded SCRAM PBKDF2 iteration count accepted from the server
Record
CLSA-2026-1781092532
Updated
2026-11-02
OSVCLSA-2026-1781608329 No score

postgresql-jdbc: Fix of CVE-2026-42198

  • update to 42.2.28
  • CVE-2024-1597: fix SQL injection in PostgreSQL JDBC simple query mode
Record
CLSA-2026-1781608329
Updated
2026-11-02
OSVopenSUSE-SU-2026:11001-1 No score

postgresql-jdbc-42.7.11-1.1 on GA media

These are all security issues fixed in the postgresql-jdbc-42.7.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11001-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20847-1 No score

Security update for postgresql-jdbc

This update for postgresql-jdbc fixes the following issue

  • CVE-2026-42198: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (bsc#1264174).
Record
openSUSE-SU-2026:20847-1
Updated
2026-11-02
OSVSUSE-SU-2026:2028-1 No score

Security update for postgresql-jdbc

This update for postgresql-jdbc fixes the following issue

  • CVE-2026-42198: client-side denial of service via malicious SCRAM-SHA-256 authentication (bsc#1264174).
Record
SUSE-SU-2026:2028-1
Updated
2026-11-02
OSVSUSE-SU-2026:22000-1 No score

Security update for postgresql-jdbc

This update for postgresql-jdbc fixes the following issue

  • CVE-2026-42198: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (bsc#1264174).
Record
SUSE-SU-2026:22000-1
Updated
2026-11-02
OSVSUSE-SU-2026:2774-1 No score

Security update 5.1.4 for Multi-Linux Manager Server

This update fixes the following issues:

Release Notes Highlights:

  • Update to SUSE Multi-Linux Manager 5.1.4
    • Added note about migration for SUSE Linux Enterprise Server 16 on SSH managed minions
    • Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0
    • SUSE Liberty Linux 9.6 Support
    • New API Endpoint - listMigrationTargetsWithChannels
    • Debian 12 End-of-Life Notice
    • SUSE Registry URL Change
    • Security fixes: CVE-2026-34986, CVE-2026-41602, CVE-2026-39821, CVE-2026-42198 CVE-2022-21698, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154 CVE-2026-28374, CVE-2026-28376, CVE-2026-28379, CVE-2026-28380 CVE-2026-28383, CVE-2026-33376, CVE-2026-33377, CVE-2026-33378 CVE-2026-33380, CVE-2026-33381
    • Bugs mentioned: bsc#1226578, bsc#1234567, bsc#1238890, bsc#1242916, bsc#1245107 bsc#1247707, bsc#1248699, bsc#1249243, bsc#1253032, bsc#1257583 bsc#1257894, bsc#1258041, bsc#1258079, bsc#1258144, bsc#1258382 bsc#1258816, bsc#1259087, bsc#1259230, bsc#1259261, bsc#1259474 bsc#1259479, bsc#1259482, bsc#1259521, bsc#1259590, bsc#1259591 bsc#1259700, bsc#1259739, bsc#1259787, bsc#1259960, bsc#1260031 bsc#1260614, bsc#1260806, bsc#1261305, bsc#1261307, bsc#1261327 bsc#1261631, bsc#1261723, bsc#1261753, bsc#1261841, bsc#1261902 bsc#1262090, bsc#1262285, bsc#1262460, bsc#1262471, bsc#1262492 bsc#1262595, bsc#1262708, bsc#1262720, bsc#1262761, bsc#1263814 bsc#1263841, bsc#1264149, bsc#1264234, bsc#1264256, bsc#1264966 bsc#1265134, bsc#1265319, bsc#1265358, bsc#1265975, bsc#1266012 bsc#1262950, bsc#1263501, bsc#1266600, bsc#1266556, bsc#1264174 bsc#1262222, bsc#1263986, bsc#1263987, bsc#1265290, bsc#1265289 bsc#1265288, bsc#1265287, bsc#1265286, bsc#1265285, bsc#1265284 bsc#1265283, bsc#1265282, bsc#1265281, bsc#1269253, bsc#1269534

Container images and uyuni-tools changes:

server-attestation-image:

  • Version 5.1.15
    • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-hub-xmlrpc-api-image:

  • Version 5.1.14
    • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-image:

  • Version 5.1.15
    • Healthcheck on disk usage based on taskomatic (bsc#1238890)
    • Added mozilla-nss-sysinit to Dockerfile required for FIPS (bsc#1247707)
    • Do not get repositories from SCC in the server container (bsc#1242916)
    • Added 'susemanager-tools', 'susemanager' and 'susemanager-tools-salt' packages to server-image

server-migration-14-16-image:

  • Version 5.1.14
    • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-postgresql-image:

  • Version 5.1.13
    • Healthcheck on disk usage based on taskomatic (bsc#1238890)
    • Added needed pg_hba rules on upgrade (bsc#1262492, bsc#1264149)

server-saline-image:

  • Version 5.1.14
    • Use python3*-tornado6 package to make it working with Python 3.11

uyuni-tools:

  • Version 5.1.29-0 Check backup status only after database is started (bsc#1262492)
  • Version 5.1.28-0
    • Remove waitForTraefik function (bsc#1261902)
    • Fix inspect: missing registry for db image (bsc#1259739)
    • Preserve hub replicas during upgrade (bsc#1262708)
    • Stop automatically unhealthy container
    • Ignore spacewalk-service stop return code.
    • Use correct CA for Report DB (bsc#1260806)
    • Do not call podman healthcheck run to wait for pods to be ready (bsc#1266012)

The following packages are underlying build dependencies and system components used by the containers:

cobbler:

  • Added the distro signature for rhel10 (bsc#1265134)

liberate-formula:

  • Version 0.1.4
    • No customer facing changes
  • Version 0.1.3
    • Liberate formula support for EL10 (bsc#1265975)

prometheus-exporters-formula:

  • Version 1.4.3
    • Added support for Python 3.13
    • Drop migrate_formula_data script as it is obsolete

prometheus-postgres_exporter:

-…

Record
SUSE-SU-2026:2774-1
Updated
2026-11-02

Affected products

Show 8 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
org.postgresql:postgresql
Maven
 42.2.0 up to 42.7.11
42.7.11
postgresql-jdbc
AlmaLinux:9
 before 42.2.28-2.el9_8.2
42.2.28-2.el9_8.2
postgresql-jdbc
AlmaLinux:10
 before 42.7.2-1.el10_2.2
42.7.2-1.el10_2.2
postgresql-jdbc
AlmaLinux:8
 before 42.2.14-4.el8_10
42.2.14-4.el8_10
postgresql-jdbc-javadoc
AlmaLinux:8
 before 42.2.14-4.el8_10
42.2.14-4.el8_10
postgresql-jdbc-driver
Bitnami
 42.2.0 up to 42.7.11
42.7.11
postgresql-jdbc
TuxCare:AlmaLinux:9.2
 before 42.2.28-1.el9.tuxcare.els2
42.2.28-1.el9.tuxcare.els2
postgresql-jdbc-javadoc
TuxCare:AlmaLinux:9.2
 before 42.2.28-1.el9.tuxcare.els2
42.2.28-1.el9.tuxcare.els2
postgresql-jdbc
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 42.2.28-1.el9_3.tuxcare.els1
42.2.28-1.el9_3.tuxcare.els1
postgresql-jdbc-javadoc
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 42.2.28-1.el9_3.tuxcare.els1
42.2.28-1.el9_3.tuxcare.els1
Show 91 moreShow less
Affected packages
PackageAffectedFixed
libpgjava
Debian:12
 All versions, plus listed versions
42.5.4-142.5.5-0+deb12u142.6.0-142.6.0-242.7.0-1
Show 16 moreShow less
42.7.1-142.7.10-142.7.11-142.7.12-142.7.13-142.7.2-142.7.3-142.7.3-242.7.5-142.7.5-242.7.6-142.7.7-142.7.7-242.7.8-142.7.8-242.7.9-1
 None known
libpgjava
Debian:13
 All versions, plus listed versions
42.7.10-142.7.11-142.7.12-142.7.13-142.7.7-1
Show 4 moreShow less
42.7.7-242.7.8-142.7.8-242.7.9-1
 None known
libpgjava
Debian:14
 before 42.7.11-1, plus listed versions
42.7.10-142.7.7-142.7.7-242.7.8-142.7.8-242.7.9-1
42.7.11-1
org.postgresql:postgresql
Maven
 42.2.0 up to 42.7.11, plus listed versions
42.2.0.jre642.2.0.jre742.2.142.2.1.jre642.2.1.jre7
Show 45 moreShow less
42.2.1042.2.10.jre642.2.10.jre742.2.1142.2.11.jre642.2.11.jre742.2.1242.2.12.jre642.2.12.jre742.2.1342.2.13.jre642.2.13.jre742.2.1442.2.14.jre642.2.14.jre742.2.1542.2.15.jre642.2.15.jre742.2.1642.2.16.jre642.2.16.jre742.2.1742.2.17.jre642.2.17.jre742.2.1842.2.18.jre642.2.18.jre742.2.1942.2.19.jre642.2.19.jre742.2.242.2.2.jre642.2.2.jre742.2.2042.2.20.jre642.2.20.jre742.2.2142.2.21.jre642.2.21.jre742.2.2242.2.22.jre642.2.22.jre742.2.2342.2.23.jre642.2.23.jre7
42.7.11
postgresql-jdbc
openEuler:24.03-LTS
 before 42.4.1-4.oe2403
42.4.1-4.oe2403
postgresql-jdbc
openEuler:24.03-LTS-SP3
 before 42.4.1-4.oe2403sp3
42.4.1-4.oe2403sp3
postgresql-jdbc
openEuler:20.03-LTS-SP4
 before 42.4.1-4.oe2003sp4
42.4.1-4.oe2003sp4
postgresql-jdbc
openEuler:22.03-LTS-SP4
 before 42.4.1-4.oe2203sp4
42.4.1-4.oe2203sp4
postgresql-jdbc
openEuler:24.03-LTS-SP1
 before 42.4.1-4.oe2403sp1
42.4.1-4.oe2403sp1
org.postgresql:postgresql
Red Hat Lightwell:Maven
 42.7.3 up to 42.7.3.rhlw-00001
42.7.3.rhlw-00001
org.postgresql:postgresql
Red Hat Lightwell:Maven
From an advisory covering 4 CVEs
 before 42.3.3.rhlw-00006, plus listed versions
42.0.042.0.0.jre642.0.0.jre742.1.042.1.0.jre7
Show 45 moreShow less
42.1.142.1.1.jre642.1.1.jre742.1.242.1.2.jre642.1.2.jre742.1.342.1.3.jre642.1.3.jre742.1.442.1.4.jre642.1.4.jre742.2.042.2.0.jre642.2.0.jre742.2.142.2.1.jre642.2.1.jre742.2.1042.2.10.jre642.2.10.jre742.2.1142.2.11.jre642.2.11.jre742.2.1242.2.12.jre642.2.12.jre742.2.1342.2.13.jre642.2.13.jre742.2.1442.2.14.jre642.2.14.jre742.2.1542.2.15.jre642.2.15.jre742.2.1642.2.16.jre642.2.16.jre742.2.1742.2.17.jre642.2.17.jre742.2.1842.2.18.jre642.2.18.jre7
42.3.3.rhlw-00006
postgresql-jdbc
Red Hat:enterprise_linux:9::appstream
 before 0:42.2.28-2.el9_8.2
0:42.2.28-2.el9_8.2
postgresql-jdbc
Red Hat:enterprise_linux:10.2
 before 0:42.7.2-1.el10_2.2
0:42.7.2-1.el10_2.2
postgresql-jdbc
Red Hat:enterprise_linux:8::appstream
 before 0:42.2.14-4.el8_10
0:42.2.14-4.el8_10
postgresql-jdbc-javadoc
Red Hat:enterprise_linux:8::appstream
 before 0:42.2.14-4.el8_10
0:42.2.14-4.el8_10
postgresql-jdbc
Red Hat:enterprise_linux_eus:10.0
 before 0:42.7.1-7.el10_0.1
0:42.7.1-7.el10_0.1
postgresql-jdbc
Red Hat:rhel_e4s:9.4::appstream
 before 0:42.2.28-1.el9_4.1
0:42.2.28-1.el9_4.1
postgresql-jdbc
Red Hat:rhel_eus:9.6::appstream
 before 0:42.2.28-1.el9_6.1
0:42.2.28-1.el9_6.1
postgresql-jdbc
Red Hat:rhel_e4s:8.8::appstream
 before 0:42.2.14-5.el8_8.1
0:42.2.14-5.el8_8.1
postgresql-jdbc-javadoc
Red Hat:rhel_e4s:8.8::appstream
 before 0:42.2.14-5.el8_8.1
0:42.2.14-5.el8_8.1
postgresql-jdbc
Red Hat:rhel_tus:8.8::appstream
 before 0:42.2.14-5.el8_8.1
0:42.2.14-5.el8_8.1
postgresql-jdbc-javadoc
Red Hat:rhel_tus:8.8::appstream
 before 0:42.2.14-5.el8_8.1
0:42.2.14-5.el8_8.1
postgresql-jdbc
Red Hat:rhel_e4s:9.2::appstream
 before 0:42.2.28-1.el9_2.1
0:42.2.28-1.el9_2.1
postgresql-jdbc
Red Hat:rhel_aus:8.6::appstream
 before 0:42.2.3-5.el8_6.1
0:42.2.3-5.el8_6.1
postgresql-jdbc-javadoc
Red Hat:rhel_aus:8.6::appstream
 before 0:42.2.3-5.el8_6.1
0:42.2.3-5.el8_6.1
postgresql-jdbc
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:42.2.3-5.el8_6.1
0:42.2.3-5.el8_6.1
postgresql-jdbc-javadoc
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:42.2.3-5.el8_6.1
0:42.2.3-5.el8_6.1
postgresql-jdbc
Red Hat:rhel_aus:8.4::appstream
 before 0:42.2.3-7.el8_4.1
0:42.2.3-7.el8_4.1
postgresql-jdbc-javadoc
Red Hat:rhel_aus:8.4::appstream
 before 0:42.2.3-7.el8_4.1
0:42.2.3-7.el8_4.1
postgresql-jdbc
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:42.2.3-7.el8_4.1
0:42.2.3-7.el8_4.1
postgresql-jdbc-javadoc
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:42.2.3-7.el8_4.1
0:42.2.3-7.el8_4.1
postgresql-jdbc
Rocky Linux:9
 before 0:42.2.28-2.el9_8.2
0:42.2.28-2.el9_8.2
postgresql-jdbc
Rocky Linux:10
 before 0:42.7.2-1.el10_2.2
0:42.7.2-1.el10_2.2
postgresql-jdbc
Rocky Linux:8
 before 0:42.2.14-4.el8_10
0:42.2.14-4.el8_10
org.postgresql:postgresql
Root:Maven
 before 42.7.10-aikido.1
42.7.10-aikido.142.7.4-aikido.342.7.4-aikido.442.5.1-aikido.242.7.7-aikido.142.6.0-aikido.342.7.11-aikido.1
io.root.org.postgresql:postgresql
Root:Maven
 before 42.7.10-root.io.1
42.7.10-root.io.142.6.0-root.io.242.7.4-root.io.142.7.4-root.io.242.7.4-root.io.342.7.4-root.io.442.5.1-root.io.242.7.7-root.io.142.6.0-root.io.342.7.11-root.io.1
postgresql-jdbc
SUSE:Linux Enterprise Server 16.0
 before 42.7.7-160000.3.1
42.7.7-160000.3.1
postgresql-jdbc
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 42.7.7-160000.3.1
42.7.7-160000.3.1
suse-multi-linux-manager-5.1-aarch64-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-aarch64-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-aarch64-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-aarch64-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-aarch64-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-ppc64le-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-ppc64le-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-ppc64le-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-ppc64le-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-ppc64le-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-s390x-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-s390x-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-s390x-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.22
5.1.4-8.22.22
suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.25
5.1.4-9.20.25
suse-multi-linux-manager-5.1-x86_64-proxy-squid-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.11
5.1.4-8.20.11
suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
uyuni-tools
SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.29-150700.3.26.1
5.1.29-150700.3.26.1
suse-multi-linux-manager-5.1-aarch64-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-aarch64-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-aarch64-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-aarch64-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-aarch64-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-aarch64-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
suse-multi-linux-manager-5.1-ppc64le-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-ppc64le-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-ppc64le-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-ppc64le-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-ppc64le-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-ppc64le-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
suse-multi-linux-manager-5.1-s390x-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-s390x-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-s390x-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-s390x-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
suse-multi-linux-manager-5.1-x86_64-server-attestation-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.22.10
5.1.4-8.22.10
suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.12
5.1.4-8.20.12
suse-multi-linux-manager-5.1-x86_64-server-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.34
5.1.4-8.20.34
suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-8.20.13
5.1.4-8.20.13
suse-multi-linux-manager-5.1-x86_64-server-postgresql-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-6.24.3
5.1.4-6.24.3
suse-multi-linux-manager-5.1-x86_64-server-saline-image
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.4-9.20.24
5.1.4-9.20.24
uyuni-tools
SUSE:Multi-Linux Manager Server Extension for SLE 5.1
From an advisory covering 18 CVEs
 before 5.1.29-150700.3.26.1
5.1.29-150700.3.26.1
libpgjava
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
42.2.6-142.2.8-142.2.9-142.2.10-142.2.10-1ubuntu0.1~esm1
 None known
libpgjava
Ubuntu:22.04:LTS
 All versions, plus listed versions
42.2.23-142.2.24-142.3.1-142.3.2-142.3.3-1
 None known
libpgjava
Ubuntu:24.04:LTS
 All versions, plus listed versions
42.5.4-142.6.0-242.7.0-142.7.1-142.7.2-1
 None known
libpgjava
Ubuntu:25.10
 All versions, plus listed versions
42.7.5-142.7.5-242.7.7-1
 None known
libpgjava
Ubuntu:26.10
 All versions, plus listed versions
42.7.10-142.7.11-142.7.12-142.7.13-1
 None known
libpgjava
Ubuntu:26.04:LTS
 All versions, plus listed versions
42.7.7-142.7.8-142.7.8-242.7.9-142.7.10-1
 None known
postgresql-jdbc
openSUSE:Tumbleweed
 before 42.7.11-1.1
42.7.11-1.1

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42198 is a high vulnerability (CVSS 7.5) in Pgjdbc, published April 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.26%, the 88th percentile. Fixed in org.postgresql:postgresql 42.7.11.

References

Show 162 moreShow less
This page doesn't list everything

Left out here: 190 versions and the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open