{"id":"CVE-2026-42198","aliases":["ALSA-2026:22304","ALSA-2026:24348","ALSA-2026:25030","BIT-postgresql-jdbc-driver-2026-42198","CLSA-2026-1781092532","CLSA-2026-1781608329","DEBIAN-CVE-2026-42198","EUVD-2026-26247","GHSA-98qh-xjc8-98pq","OESA-2026-2443","OESA-2026-2444","OESA-2026-2445","OESA-2026-2446","OESA-2026-2501","RHLW-2026-5920e9c5f3ada010","RHLW-2026-b44d1f7dac7a0d3d","RHSA-2026:22304","RHSA-2026:24348","RHSA-2026:25030","RHSA-2026:52928","RHSA-2026:52929","RHSA-2026:52930","RHSA-2026:52978","RHSA-2026:54532","RHSA-2026:59277","RHSA-2026:59278","RLSA-2026:22304","RLSA-2026:24348","RLSA-2026:25030","ROOT-APP-MAVEN-CVE-2026-42198","SUSE-SU-2026:2028-1","SUSE-SU-2026:22000-1","SUSE-SU-2026:2774-1","UBUNTU-CVE-2026-42198","openSUSE-SU-2026:11001-1","openSUSE-SU-2026:20847-1"],"status":"published","title":"pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS","description":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.03261,"percentile":0.88551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-04-29T15:58:49Z","modified":"2026-11-12T10:00:55Z","fixes":[{"ecosystem":"Maven","package":"org.postgresql:postgresql","fixed_in":["42.7.11"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:9","package":"postgresql-jdbc","fixed_in":["42.2.28-2.el9_8.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"postgresql-jdbc","fixed_in":["42.7.2-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"postgresql-jdbc","fixed_in":["42.2.14-4.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"postgresql-jdbc-javadoc","fixed_in":["42.2.14-4.el8_10"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"postgresql-jdbc-driver","fixed_in":["42.7.11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postgresql-jdbc","fixed_in":["42.2.28-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postgresql-jdbc-javadoc","fixed_in":["42.2.28-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpgjava","fixed_in":["42.7.11-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"postgresql-jdbc","fixed_in":["42.4.1-4.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"postgresql-jdbc","fixed_in":["42.4.1-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"postgresql-jdbc","fixed_in":["42.4.1-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"postgresql-jdbc","fixed_in":["42.4.1-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"postgresql-jdbc","fixed_in":["42.4.1-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.postgresql:postgresql","fixed_in":["42.7.3.rhlw-00001"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.28-2.el9_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql-jdbc","fixed_in":["0:42.7.2-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.14-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.14-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"postgresql-jdbc","fixed_in":["0:42.7.1-7.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.28-1.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.28-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.14-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.14-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.14-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.14-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.28-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-5.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-5.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-5.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-5.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-7.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-7.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-7.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-7.el8_4.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"postgresql-jdbc","fixed_in":["0:42.2.28-2.el9_8.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"postgresql-jdbc","fixed_in":["0:42.7.2-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"postgresql-jdbc","fixed_in":["0:42.2.14-4.el8_10"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.postgresql:postgresql","fixed_in":["42.7.10-aikido.1","42.7.4-aikido.3","42.7.4-aikido.4","42.5.1-aikido.2","42.7.7-aikido.1","42.6.0-aikido.3","42.7.11-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.postgresql:postgresql","fixed_in":["42.7.10-root.io.1","42.6.0-root.io.2","42.7.4-root.io.1","42.7.4-root.io.2","42.7.4-root.io.3","42.7.4-root.io.4","42.5.1-root.io.2","42.7.7-root.io.1","42.6.0-root.io.3","42.7.11-root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"postgresql-jdbc","fixed_in":["42.7.7-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"postgresql-jdbc","fixed_in":["42.7.7-160000.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"postgresql-jdbc","fixed_in":["42.7.11-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.2.0"},{"fixed":"42.7.11"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28-2.el9_8.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.2-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.14-4.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.14-4.el8_10"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"postgresql-jdbc-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"42.2.0"},{"fixed":"42.7.11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28-1.el9_3.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28-1.el9_3.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.5.4-1","42.5.5-0+deb12u1","42.6.0-1","42.6.0-2","42.7.0-1","42.7.1-1","42.7.10-1","42.7.11-1","42.7.12-1","42.7.13-1","42.7.14-1","42.7.2-1","42.7.3-1","42.7.3-2","42.7.5-1","42.7.5-2","42.7.6-1","42.7.7-1","42.7.7-2","42.7.8-1","42.7.8-2","42.7.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.7.10-1","42.7.11-1","42.7.12-1","42.7.13-1","42.7.14-1","42.7.7-1","42.7.7-2","42.7.8-1","42.7.8-2","42.7.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.11-1"}]}],"versions":["42.7.10-1","42.7.7-1","42.7.7-2","42.7.8-1","42.7.8-2","42.7.9-1"]},{"source":"osv","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.2.0"},{"fixed":"42.7.11"}]}],"versions":["42.2.0","42.2.0.jre6","42.2.0.jre7","42.2.1","42.2.1.jre6","42.2.1.jre7","42.2.10","42.2.10.jre6","42.2.10.jre7","42.2.11","42.2.11.jre6","42.2.11.jre7","42.2.12","42.2.12.jre6","42.2.12.jre7","42.2.13","42.2.13.jre6","42.2.13.jre7","42.2.14","42.2.14.jre6","42.2.14.jre7","42.2.15","42.2.15.jre6","42.2.15.jre7","42.2.16","42.2.16.jre6","42.2.16.jre7","42.2.17","42.2.17.jre6","42.2.17.jre7","42.2.18","42.2.18.jre6","42.2.18.jre7","42.2.19","42.2.19.jre6","42.2.19.jre7","42.2.2","42.2.2.jre6","42.2.2.jre7","42.2.20","42.2.20.jre6","42.2.20.jre7","42.2.21","42.2.21.jre6","42.2.21.jre7","42.2.22","42.2.22.jre6","42.2.22.jre7","42.2.23","42.2.23.jre6","42.2.23.jre7","42.2.24","42.2.24.jre6","42.2.24.jre7","42.2.25","42.2.25.jre6","42.2.25.jre7","42.2.26","42.2.26.jre6","42.2.26.jre7","42.2.27","42.2.27.jre6","42.2.27.jre7","42.2.28","42.2.28.jre7","42.2.29","42.2.3","42.2.3.jre6","42.2.3.jre7","42.2.4","42.2.4.jre6","42.2.4.jre7","42.2.5","42.2.5.jre6","42.2.5.jre7","42.2.6","42.2.6.jre6","42.2.6.jre7","42.2.7","42.2.7.jre6","42.2.7.jre7","42.2.8","42.2.8.jre6","42.2.8.jre7","42.2.9","42.2.9.jre6","42.2.9.jre7","42.3.0","42.3.1","42.3.10","42.3.2","42.3.3","42.3.4","42.3.5","42.3.6","42.3.7","42.3.8","42.3.9","42.4.0","42.4.1","42.4.2","42.4.3","42.4.4","42.4.5","42.5.0","42.5.1","42.5.2","42.5.3","42.5.4","42.5.5","42.5.6","42.6.0","42.6.1","42.6.2","42.7.0","42.7.1","42.7.10","42.7.2","42.7.3","42.7.4","42.7.5","42.7.6","42.7.7","42.7.8","42.7.9"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.4.1-4.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.4.1-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.4.1-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.4.1-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.4.1-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.7.3"},{"fixed":"42.7.3.rhlw-00001"}]}],"versions":["42.7.3"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3.3.rhlw-00006"}]}],"versions":["42.0.0","42.0.0.jre6","42.0.0.jre7","42.1.0","42.1.0.jre7","42.1.1","42.1.1.jre6","42.1.1.jre7","42.1.2","42.1.2.jre6","42.1.2.jre7","42.1.3","42.1.3.jre6","42.1.3.jre7","42.1.4","42.1.4.jre6","42.1.4.jre7","42.2.0","42.2.0.jre6","42.2.0.jre7","42.2.1","42.2.1.jre6","42.2.1.jre7","42.2.10","42.2.10.jre6","42.2.10.jre7","42.2.11","42.2.11.jre6","42.2.11.jre7","42.2.12","42.2.12.jre6","42.2.12.jre7","42.2.13","42.2.13.jre6","42.2.13.jre7","42.2.14","42.2.14.jre6","42.2.14.jre7","42.2.15","42.2.15.jre6","42.2.15.jre7","42.2.16","42.2.16.jre6","42.2.16.jre7","42.2.17","42.2.17.jre6","42.2.17.jre7","42.2.18","42.2.18.jre6","42.2.18.jre7","42.2.19","42.2.19.jre6","42.2.19.jre7","42.2.2","42.2.2.jre6","42.2.2.jre7","42.2.20","42.2.20.jre6","42.2.20.jre7","42.2.21","42.2.21.jre6","42.2.21.jre7","42.2.22","42.2.22.jre6","42.2.22.jre7","42.2.23","42.2.23.jre6","42.2.23.jre7","42.2.24","42.2.24.jre6","42.2.24.jre7","42.2.25","42.2.25.jre6","42.2.25.jre7","42.2.26","42.2.26.jre6","42.2.26.jre7","42.2.27","42.2.27.jre6","42.2.27.jre7","42.2.28","42.2.28.jre7","42.2.29","42.2.29.jre7","42.2.3","42.2.3.jre6","42.2.3.jre7","42.2.4","42.2.4.jre6","42.2.4.jre7","42.2.5","42.2.5.jre6","42.2.5.jre7","42.2.6","42.2.6.jre6","42.2.6.jre7","42.2.7","42.2.7.jre6","42.2.7.jre7","42.2.8","42.2.8.jre6","42.2.8.jre7","42.2.9","42.2.9.jre6","42.2.9.jre7","42.3.0","42.3.1","42.3.2","42.3.3","9.2-1002-jdbc4","9.2-1003-jdbc3","9.2-1003-jdbc4","9.2-1004-jdbc3","9.2-1004-jdbc4","9.2-1004-jdbc41","9.3-1100-jdbc3","9.3-1100-jdbc4","9.3-1100-jdbc41","9.3-1101-jdbc3","9.3-1101-jdbc4","9.3-1101-jdbc41","9.3-1102-jdbc3","9.3-1102-jdbc4","9.3-1102-jdbc41","9.3-1103-jdbc3","9.3-1103-jdbc4","9.3-1103-jdbc41","9.3-1104-jdbc4","9.3-1104-jdbc41","9.4-1200-jdbc4","9.4-1200-jdbc41","9.4-1201-jdbc4","9.4-1201-jdbc41","9.4-1202-jdbc4","9.4-1202-jdbc41","9.4-1202-jdbc42","9.4-1203-jdbc4","9.4-1203-jdbc41","9.4-1203-jdbc42","9.4-1204-jdbc4","9.4-1204-jdbc41","9.4-1204-jdbc42","9.4-1205-jdbc4","9.4-1205-jdbc41","9.4-1205-jdbc42","9.4-1206-jdbc4","9.4-1206-jdbc41","9.4-1206-jdbc42","9.4.1207","9.4.1207.jre6","9.4.1207.jre7","9.4.1208","9.4.1208.jre6","9.4.1208.jre7","9.4.1209","9.4.1209.jre6","9.4.1209.jre7","9.4.1210","9.4.1210.jre6","9.4.1210.jre7","9.4.1211","9.4.1211.jre6","9.4.1211.jre7","9.4.1212","9.4.1212.jre6","9.4.1212.jre7"],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.28-2.el9_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.7.2-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.7.1-7.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.28-1.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.28-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.28-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-7.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-7.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-7.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-7.el8_4.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.28-2.el9_8.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.7.2-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-4.el8_10"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.10-aikido.1"},{"fixed":"42.7.4-aikido.3"},{"fixed":"42.7.4-aikido.4"},{"fixed":"42.5.1-aikido.2"},{"fixed":"42.7.7-aikido.1"},{"fixed":"42.6.0-aikido.3"},{"fixed":"42.7.11-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.10-root.io.1"},{"fixed":"42.6.0-root.io.2"},{"fixed":"42.7.4-root.io.1"},{"fixed":"42.7.4-root.io.2"},{"fixed":"42.7.4-root.io.3"},{"fixed":"42.7.4-root.io.4"},{"fixed":"42.5.1-root.io.2"},{"fixed":"42.7.7-root.io.1"},{"fixed":"42.6.0-root.io.3"},{"fixed":"42.7.11-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.7-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.7-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.29-150700.3.26.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.29-150700.3.26.1"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.2.6-1","42.2.8-1","42.2.9-1","42.2.10-1","42.2.10-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.2.23-1","42.2.24-1","42.3.1-1","42.3.2-1","42.3.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.5.4-1","42.6.0-2","42.7.0-1","42.7.1-1","42.7.2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.7.5-1","42.7.5-2","42.7.7-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.7.10-1","42.7.11-1","42.7.12-1","42.7.13-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.7.7-1","42.7.8-1","42.7.8-2","42.7.9-1","42.7.10-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.11-1.1"}]}]}],"products":[{"vendor":"pgjdbc","product":"pgjdbc"},{"vendor":"postgresql","product":"postgresql_jdbc_driver"},{"vendor":"red hat","product":"red hat amq broker 7.13.6"},{"vendor":"red hat","product":"red hat amq broker 7.14.1"},{"vendor":"red hat","product":"red hat build of quarkus 3.27.3.sp2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11","tags":["x_refsource_MISC","Release Notes","article","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42198","tags":["vdb-entry","x_refsource_REDHAT","report","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463857","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42198.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52928","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24348","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25030","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59278","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59277","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52978","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54532","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52929","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52930","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22304","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19098","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42198","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-98qh-xjc8-98pq","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2463857","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-22304.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-24348.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-25030.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1781092532.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1781608329.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42198.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42198","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2443","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2444","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2445","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2446","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2501","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31197.json","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31197","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/739e599d52ad80f8dcd6efedc6157859b1a9d637","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-r38f-c4h4-hqq2","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41946.json","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-562r-vg33-8x8h","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41946","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/9008dc9aade6dbfe4efafcd6872ebc55f4699cf5","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-562r-vg33-8x8h","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1597.json","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1597","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-24rp-q3w6-vc56","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22304.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42198","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24348.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25030.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52928.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52929.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52930.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52978.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54532.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59277.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59278.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:22304","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:24348","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:25030","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262028-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264174","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42198","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622000-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262774-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226578","tags":["report"]},{"url":"https://bugzilla.suse.com/1234567","tags":["report"]},{"url":"https://bugzilla.suse.com/1238890","tags":["report"]},{"url":"https://bugzilla.suse.com/1242916","tags":["report"]},{"url":"https://bugzilla.suse.com/1245107","tags":["report"]},{"url":"https://bugzilla.suse.com/1247707","tags":["report"]},{"url":"https://bugzilla.suse.com/1248699","tags":["report"]},{"url":"https://bugzilla.suse.com/1249243","tags":["report"]},{"url":"https://bugzilla.suse.com/1253032","tags":["report"]},{"url":"https://bugzilla.suse.com/1254900","tags":["report"]},{"url":"https://bugzilla.suse.com/1257583","tags":["report"]},{"url":"https://bugzilla.suse.com/1257894","tags":["report"]},{"url":"https://bugzilla.suse.com/1258041","tags":["report"]},{"url":"https://bugzilla.suse.com/1258079","tags":["report"]},{"url":"https://bugzilla.suse.com/1258144","tags":["report"]},{"url":"https://bugzilla.suse.com/1258382","tags":["report"]},{"url":"https://bugzilla.suse.com/1258816","tags":["report"]},{"url":"https://bugzilla.suse.com/1259087","tags":["report"]},{"url":"https://bugzilla.suse.com/1259230","tags":["report"]},{"url":"https://bugzilla.suse.com/1259261","tags":["report"]},{"url":"https://bugzilla.suse.com/1259474","tags":["report"]},{"url":"https://bugzilla.suse.com/1259479","tags":["report"]},{"url":"https://bugzilla.suse.com/1259482","tags":["report"]},{"url":"https://bugzilla.suse.com/1259521","tags":["report"]},{"url":"https://bugzilla.suse.com/1259590","tags":["report"]},{"url":"https://bugzilla.suse.com/1259591","tags":["report"]},{"url":"https://bugzilla.suse.com/1259700","tags":["report"]},{"url":"https://bugzilla.suse.com/1259739","tags":["report"]},{"url":"https://bugzilla.suse.com/1259787","tags":["report"]},{"url":"https://bugzilla.suse.com/1259960","tags":["report"]},{"url":"https://bugzilla.suse.com/1260031","tags":["report"]},{"url":"https://bugzilla.suse.com/1260614","tags":["report"]},{"url":"https://bugzilla.suse.com/1260806","tags":["report"]},{"url":"https://bugzilla.suse.com/1261305","tags":["report"]},{"url":"https://bugzilla.suse.com/1261307","tags":["report"]},{"url":"https://bugzilla.suse.com/1261327","tags":["report"]},{"url":"https://bugzilla.suse.com/1261631","tags":["report"]},{"url":"https://bugzilla.suse.com/1261723","tags":["report"]},{"url":"https://bugzilla.suse.com/1261753","tags":["report"]},{"url":"https://bugzilla.suse.com/1261841","tags":["report"]},{"url":"https://bugzilla.suse.com/1261902","tags":["report"]},{"url":"https://bugzilla.suse.com/1262090","tags":["report"]},{"url":"https://bugzilla.suse.com/1262222","tags":["report"]},{"url":"https://bugzilla.suse.com/1262285","tags":["report"]},{"url":"https://bugzilla.suse.com/1262460","tags":["report"]},{"url":"https://bugzilla.suse.com/1262471","tags":["report"]},{"url":"https://bugzilla.suse.com/1262492","tags":["report"]},{"url":"https://bugzilla.suse.com/1262595","tags":["report"]},{"url":"https://bugzilla.suse.com/1262708","tags":["report"]},{"url":"https://bugzilla.suse.com/1262720","tags":["report"]},{"url":"https://bugzilla.suse.com/1262760","tags":["report"]},{"url":"https://bugzilla.suse.com/1262761","tags":["report"]},{"url":"https://bugzilla.suse.com/1262950","tags":["report"]},{"url":"https://bugzilla.suse.com/1263501","tags":["report"]},{"url":"https://bugzilla.suse.com/1263814","tags":["report"]},{"url":"https://bugzilla.suse.com/1263841","tags":["report"]},{"url":"https://bugzilla.suse.com/1263986","tags":["report"]},{"url":"https://bugzilla.suse.com/1263987","tags":["report"]},{"url":"https://bugzilla.suse.com/1264149","tags":["report"]},{"url":"https://bugzilla.suse.com/1264234","tags":["report"]},{"url":"https://bugzilla.suse.com/1264256","tags":["report"]},{"url":"https://bugzilla.suse.com/1264966","tags":["report"]},{"url":"https://bugzilla.suse.com/1265134","tags":["report"]},{"url":"https://bugzilla.suse.com/1265281","tags":["report"]},{"url":"https://bugzilla.suse.com/1265282","tags":["report"]},{"url":"https://bugzilla.suse.com/1265283","tags":["report"]},{"url":"https://bugzilla.suse.com/1265284","tags":["report"]},{"url":"https://bugzilla.suse.com/1265285","tags":["report"]},{"url":"https://bugzilla.suse.com/1265286","tags":["report"]},{"url":"https://bugzilla.suse.com/1265287","tags":["report"]},{"url":"https://bugzilla.suse.com/1265288","tags":["report"]},{"url":"https://bugzilla.suse.com/1265289","tags":["report"]},{"url":"https://bugzilla.suse.com/1265290","tags":["report"]},{"url":"https://bugzilla.suse.com/1265319","tags":["report"]},{"url":"https://bugzilla.suse.com/1265358","tags":["report"]},{"url":"https://bugzilla.suse.com/1265975","tags":["report"]},{"url":"https://bugzilla.suse.com/1266012","tags":["report"]},{"url":"https://bugzilla.suse.com/1266556","tags":["report"]},{"url":"https://bugzilla.suse.com/1266600","tags":["report"]},{"url":"https://bugzilla.suse.com/1269253","tags":["report"]},{"url":"https://bugzilla.suse.com/1269534","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42154","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-42198","tags":["report"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/c9d41d1332a7426fcef19ff89f2e6b1116429143","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-42198","title":"pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS","description":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.","status":"published","published":"2026-04-29T15:58:49.174Z","modified":"2026-09-11T12:09:08.316Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770","CWE-770"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-26247","description":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.","status":"published","published":"2026-04-29T15:58:49Z","modified":"2026-09-11T12:09:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:22.994693Z"}],"ghsa":[{"id":"GHSA-98qh-xjc8-98pq","title":"pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS","description":"## Summary\npgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication.\n\n### Impact\nA malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count.\nWith a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail.\nA single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools.\n\nIn affected versions, `loginTimeout` did not fully mitigate this problem. When `loginTimeout` expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation.\n\nThis issue affects availability. It does **not** provide authentication bypass, privilege escalation, or direct password disclosure.\n\nA user is vulnerable when **all** of the following are true:\n\n1. The connection uses **SCRAM-SHA-256** authentication.\n2. The client reaches a **malicious, compromised, or attacker-controlled PostgreSQL endpoint**.\n3. That endpoint sends a very large SCRAM PBKDF2 iteration count in the `server-first-message`.\n\nIn practice, that can happen in these situations:\n\n- the application lets end users or tenants supply their own database connection details (as in many BI, reporting, analytics, ETL, and low-code platforms), so a user can point the shared client host at a server they control\n- the application accepts connection strings, hostnames, or JDBC URLs from user input, configuration uploaded by users, or other untrusted sources\n- the application is configured to connect to a PostgreSQL server that is itself malicious or later becomes compromised\n- the application connects through an untrusted proxy, relay, tunnel, bastion, or connection-pooling service that can act as the PostgreSQL server\n- an attacker can redirect the client to a fake PostgreSQL endpoint by manipulating DNS, service discovery, Kubernetes service resolution, `/etc/hosts`, environment variables, or similar indirection\n- an active network attacker on the path can impersonate the server because the connection does not strongly verify server identity (for example, `sslmode` lower than `verify-full`, or trusting a CA that signs hosts outside the operator's control)\n\nThe issue is **more damaging** when the application uses connection retries, many parallel connection attempts, or `loginTimeout` and assumes the timeout fully stops the work.\n\n### Patches\nThe patch introduces a new connection property, `scramMaxIterations`, with a default of 100K. The client now rejects SCRAM server messages that advertise more PBKDF2 iterations than the configured cap before starting the PBKDF2 computation begins.\n\n### Workarounds\n\nUntil a patched version of pgjdbc is deployed, the following measures reduce exposure:\n\n1. **Only connect to trusted PostgreSQL servers whose identity is verified.**  \n   Connect only to trusted PostgreSQL servers, and verify server identity with TLS using sslmode=verify-full and a trusted CA.\n   TLS without certificate and hostname verification is not sufficient as an active network attacker can still impersonate the server.\n\n2. **Do not rely on `loginTimeout` as a complete mitigation on unpatched versions.**  \n   On affected versions, `loginTimeout` can stop the waiting caller while the worker thread continues spending CPU.\n\n3. **Avoid SCRAM on untrusted or interceptable connection paths.**  \n   For those paths, use an authentication method that does not let the server choose a SCRAM PBKDF2 iteration count.\n\n4. **Reduce blast radius operationally.**  \n   Limit parallel connection attempts, add retry backoff, isolate connection establishment in a separate worker or process when possible, and apply CPU or container limits where appropriate.\n\n5. **On trusted servers you control, keep SCRAM iteration counts at ordinary values.**  \n   This does not defend against an attacker-controlled server, but it avoids unnecessary client cost when talking to legitimate servers.","status":"published","published":"2026-05-05T20:09:36Z","modified":"2026-05-05T20:09:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:01.917039Z"}],"nvd":[{"id":"CVE-2026-42198","description":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.","status":"published","published":"2026-04-29T16:16:25.427Z","modified":"2026-11-11T21:10:00.2Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-11T23:26:36.997374Z"}],"osv":[{"id":"CVE-2026-42198","title":"pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS","description":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.","status":"published","published":"2026-04-29T15:58:49.174Z","modified":"2026-10-28T02:31:13.005037284Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"DEBIAN-CVE-2026-42198","description":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.","status":"published","published":"2026-04-29T16:16:25.427Z","modified":"2026-11-12T10:00:55.219352787Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-12T10:16:18.390123Z"},{"id":"GHSA-98qh-xjc8-98pq","title":"pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS","description":"## Summary\npgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication.\n\n### Impact\nA malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count.\nWith a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail.\nA single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools.\n\nIn affected versions, `loginTimeout` did not fully mitigate this problem. When `loginTimeout` expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation.\n\nThis issue affects availability. It does **not** provide authentication bypass, privilege escalation, or direct password disclosure.\n\nA user is vulnerable when **all** of the following are true:\n\n1. The connection uses **SCRAM-SHA-256** authentication.\n2. The client reaches a **malicious, compromised, or attacker-controlled PostgreSQL endpoint**.\n3. That endpoint sends a very large SCRAM PBKDF2 iteration count in the `server-first-message`.\n\nIn practice, that can happen in these situations:\n\n- the application lets end users or tenants supply their own database connection details (as in many BI, reporting, analytics, ETL, and low-code platforms), so a user can point the shared client host at a server they control\n- the application accepts connection strings, hostnames, or JDBC URLs from user input, configuration uploaded by users, or other untrusted sources\n- the application is configured to connect to a PostgreSQL server that is itself malicious or later becomes compromised\n- the application connects through an untrusted proxy, relay, tunnel, bastion, or connection-pooling service that can act as the PostgreSQL server\n- an attacker can redirect the client to a fake PostgreSQL endpoint by manipulating DNS, service discovery, Kubernetes service resolution, `/etc/hosts`, environment variables, or similar indirection\n- an active network attacker on the path can impersonate the server because the connection does not strongly verify server identity (for example, `sslmode` lower than `verify-full`, or trusting a CA that signs hosts outside the operator's control)\n\nThe issue is **more damaging** when the application uses connection retries, many parallel connection attempts, or `loginTimeout` and assumes the timeout fully stops the work.\n\n### Patches\nThe patch introduces a new connection property, `scramMaxIterations`, with a default of 100K. The client now rejects SCRAM server messages that advertise more PBKDF2 iterations than the configured cap before starting the PBKDF2 computation begins.\n\n### Workarounds\n\nUntil a patched version of pgjdbc is deployed, the following measures reduce exposure:\n\n1. **Only connect to trusted PostgreSQL servers whose identity is verified.**  \n   Connect only to trusted PostgreSQL servers, and verify server identity with TLS using sslmode=verify-full and a trusted CA.\n   TLS without certificate and hostname verification is not sufficient as an active network attacker can still impersonate the server.\n\n2. **Do not rely on `loginTimeout` as a complete mitigation on unpatched versions.**  \n   On affected versions, `loginTimeout` can stop the waiting caller while the worker thread continues spending CPU.\n\n3. **Avoid SCRAM on untrusted or interceptable connection paths.**  \n   For those paths, use an authentication method that does not let the server choose a SCRAM PBKDF2 iteration count.\n\n4. **Reduce blast radius operationally.**  \n   Limit parallel connection attempts, add retry backoff, isolate connection establishment in a separate worker or process when possible, and apply CPU or container limits where appropriate.\n\n5. **On trusted servers you control, keep SCRAM iteration counts at ordinary values.**  \n   This does not defend against an attacker-controlled server, but it avoids unnecessary client cost when talking to legitimate servers.","status":"published","published":"2026-05-05T20:09:36Z","modified":"2026-09-10T03:51:05.114618777Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"OESA-2026-2443","title":"postgresql-jdbc security update","description":"PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.\r\n\r\nSecurity Fix(es):\n\npgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:19:59.657514465Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2444","title":"postgresql-jdbc security update","description":"PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.\r\n\r\nSecurity Fix(es):\n\npgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:19:59.68510839Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2445","title":"postgresql-jdbc security update","description":"PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.\r\n\r\nSecurity Fix(es):\n\npgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:19:59.23773073Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2446","title":"postgresql-jdbc security update","description":"PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.\r\n\r\nSecurity Fix(es):\n\npgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:19:59.395823006Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2501","title":"postgresql-jdbc security update","description":"PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.\r\n\r\nSecurity Fix(es):\n\npgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.385555308Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHLW-2026-5920e9c5f3ada010","title":"Lightwell Security Advisory: postgresql 42.7.3.rhlw-00001","description":"Red Hat Lightwell has released org.postgresql:postgresql 42.7.3.rhlw-00001 with a backported security fix.\n\nCVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS\n\nThis patched artifact is a drop-in replacement for org.postgresql:postgresql 42.7.3 from Maven Central.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-29T14:30:07.181321023Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-b44d1f7dac7a0d3d","title":"Lightwell Security Advisory: postgresql 42.3.3.rhlw-00006","description":"Red Hat Lightwell has released org.postgresql:postgresql 42.3.3.rhlw-00006 with backported fixes for CVE-2022-31197, CVE-2022-41946, CVE-2024-1597, and CVE-2026-42198.\n\nCVE-2022-31197: SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc\n\nCVE-2022-41946: TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc\n\nCVE-2024-1597: pgjdbc SQL Injection via line comment generation\n\nCVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS\n\nThis patched artifact is a drop-in replacement for org.postgresql:postgresql 42.3.3 from Maven Central.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-27T04:13:04.315085632Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2026:22304","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2026-06-02T10:08:35Z","modified":"2026-10-20T10:06:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:24348","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2026-06-08T10:06:41Z","modified":"2026-10-20T10:06:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:25030","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2026-06-10T10:08:09Z","modified":"2026-10-20T10:06:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:52928","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2026-08-11T10:12:04Z","modified":"2026-10-20T10:10:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:52929","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2026-08-11T10:12:04Z","modified":"2026-10-20T10:10:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:52930","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2026-08-11T10:12:05Z","modified":"2026-10-20T10:10:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:52978","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2026-08-11T10:12:09Z","modified":"2026-10-20T10:10:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54532","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2026-08-14T10:16:49Z","modified":"2026-10-20T10:11:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:59277","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2026-08-25T10:23:24Z","modified":"2026-10-20T10:12:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:59278","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2026-08-25T10:23:25Z","modified":"2026-10-20T10:12:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:22304","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.\n\nSecurity Fix(es):\n\n* jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-02T18:03:08.506628Z","modified":"2026-06-02T18:25:40.99584Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:24348","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.\n\nSecurity Fix(es):\n\n* jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-11T12:05:12.507415Z","modified":"2026-06-11T12:30:13.372181098Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:25030","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.\n\nSecurity Fix(es):\n\n* jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-11T06:00:31.924636Z","modified":"2026-06-11T06:30:05.479934309Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-42198","title":"CVE-2026-42198 in org.postgresql:postgresql - Patched by Root","description":"Root has patched CVE-2026-42198 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-23T11:06:47Z","modified":"2026-09-23T12:15:03.374814177Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2026-42198","description":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.","status":"published","published":"2026-04-29T16:16:00Z","modified":"2026-11-04T20:04:19.271601642Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T21:43:41.994988Z"},{"id":"ALSA-2026:22304","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.  \n\nSecurity Fix(es):  \n\n  * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-10-29T11:32:33.906719903Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:24348","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.  \n\nSecurity Fix(es):  \n\n  * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-08T00:00:00Z","modified":"2026-10-29T11:30:25.662341935Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:25030","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.  \n\nSecurity Fix(es):  \n\n  * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-10T00:00:00Z","modified":"2026-10-29T11:02:23.939531861Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"BIT-postgresql-jdbc-driver-2026-42198","title":"pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS","description":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.","status":"published","published":"2026-05-01T08:48:37.375Z","modified":"2026-09-12T09:15:02.725066107Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"CLSA-2026-1781092532","title":"postgresql-jdbc: Fix of CVE-2026-42198","description":"- CVE-2026-42198: fix unbounded SCRAM PBKDF2 iteration count accepted from the server","status":"published","published":"2026-06-10T11:58:16Z","modified":"2026-10-26T09:30:18.932503686Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781608329","title":"postgresql-jdbc: Fix of CVE-2026-42198","description":"- update to 42.2.28\n- CVE-2024-1597: fix SQL injection in PostgreSQL JDBC simple query mode","status":"published","published":"2026-06-16T11:12:24Z","modified":"2026-10-26T09:43:51.518417799Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"openSUSE-SU-2026:11001-1","title":"postgresql-jdbc-42.7.11-1.1 on GA media","description":"These are all security issues fixed in the postgresql-jdbc-42.7.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-06-12T08:45:08.56554525Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20847-1","title":"Security update for postgresql-jdbc","description":"This update for postgresql-jdbc fixes the following issue\n\n- CVE-2026-42198: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (bsc#1264174).\n","status":"published","published":"2026-05-29T16:36:24Z","modified":"2026-06-02T18:24:28.40406649Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:2028-1","title":"Security update for postgresql-jdbc","description":"This update for postgresql-jdbc fixes the following issue\n\n- CVE-2026-42198: client-side denial of service via malicious SCRAM-SHA-256 authentication (bsc#1264174).\n","status":"published","published":"2026-05-20T09:08:16Z","modified":"2026-05-21T08:15:06.911674217Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:22000-1","title":"Security update for postgresql-jdbc","description":"This update for postgresql-jdbc fixes the following issue\n\n- CVE-2026-42198: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (bsc#1264174).\n","status":"published","published":"2026-05-29T15:58:08Z","modified":"2026-06-09T18:24:26.906392593Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2774-1","title":"Security update 5.1.4 for Multi-Linux Manager Server","description":"This update fixes the following issues:\n\nRelease Notes Highlights:\n    \n- Update to SUSE Multi-Linux Manager 5.1.4\n  * Added note about migration for SUSE Linux Enterprise Server 16 on SSH managed minions\n  * Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0\n  * SUSE Liberty Linux 9.6 Support\n  * New API Endpoint - listMigrationTargetsWithChannels\n  * Debian 12 End-of-Life Notice\n  * SUSE Registry URL Change\n  * Security fixes:\n    CVE-2026-34986, CVE-2026-41602, CVE-2026-39821, CVE-2026-42198\n    CVE-2022-21698, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154\n    CVE-2026-28374, CVE-2026-28376, CVE-2026-28379, CVE-2026-28380\n    CVE-2026-28383, CVE-2026-33376, CVE-2026-33377, CVE-2026-33378\n    CVE-2026-33380, CVE-2026-33381\n  * Bugs mentioned:\n    bsc#1226578, bsc#1234567, bsc#1238890, bsc#1242916, bsc#1245107\n    bsc#1247707, bsc#1248699, bsc#1249243, bsc#1253032, bsc#1257583\n    bsc#1257894, bsc#1258041, bsc#1258079, bsc#1258144, bsc#1258382\n    bsc#1258816, bsc#1259087, bsc#1259230, bsc#1259261, bsc#1259474\n    bsc#1259479, bsc#1259482, bsc#1259521, bsc#1259590, bsc#1259591\n    bsc#1259700, bsc#1259739, bsc#1259787, bsc#1259960, bsc#1260031\n    bsc#1260614, bsc#1260806, bsc#1261305, bsc#1261307, bsc#1261327\n    bsc#1261631, bsc#1261723, bsc#1261753, bsc#1261841, bsc#1261902\n    bsc#1262090, bsc#1262285, bsc#1262460, bsc#1262471, bsc#1262492\n    bsc#1262595, bsc#1262708, bsc#1262720, bsc#1262761, bsc#1263814\n    bsc#1263841, bsc#1264149, bsc#1264234, bsc#1264256, bsc#1264966\n    bsc#1265134, bsc#1265319, bsc#1265358, bsc#1265975, bsc#1266012\n    bsc#1262950, bsc#1263501, bsc#1266600, bsc#1266556, bsc#1264174\n    bsc#1262222, bsc#1263986, bsc#1263987, bsc#1265290, bsc#1265289\n    bsc#1265288, bsc#1265287, bsc#1265286, bsc#1265285, bsc#1265284\n    bsc#1265283, bsc#1265282, bsc#1265281, bsc#1269253, bsc#1269534\n\nContainer images and uyuni-tools changes:\n\nserver-attestation-image:\n\n- Version 5.1.15\n  * Image rebuilt to the newest version with updated dependencies for\n    SUSE Multi-Linux Manager 5.1.4\n\nserver-hub-xmlrpc-api-image:\n\n- Version 5.1.14\n  * Image rebuilt to the newest version with updated dependencies for\n    SUSE Multi-Linux Manager 5.1.4\n\nserver-image:\n\n- Version 5.1.15\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Added mozilla-nss-sysinit to Dockerfile required for FIPS\n    (bsc#1247707)\n  * Do not get repositories from SCC in the server container\n    (bsc#1242916)\n  * Added 'susemanager-tools', 'susemanager' and\n    'susemanager-tools-salt' packages to server-image\n\nserver-migration-14-16-image:\n\n- Version 5.1.14\n  * Image rebuilt to the newest version with updated dependencies\n     for SUSE Multi-Linux Manager 5.1.4\n\nserver-postgresql-image:\n\n- Version 5.1.13\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Added needed pg_hba rules on upgrade (bsc#1262492, bsc#1264149)\n\nserver-saline-image:\n\n- Version 5.1.14\n  * Use python3*-tornado6 package to make it working with Python 3.11\n\nuyuni-tools:\n\n- Version 5.1.29-0\n  Check backup status only after database is started (bsc#1262492)\n- Version 5.1.28-0\n  * Remove waitForTraefik function (bsc#1261902)\n  * Fix inspect: missing registry for db image (bsc#1259739)\n  * Preserve hub replicas during upgrade (bsc#1262708)\n  * Stop automatically unhealthy container\n  * Ignore spacewalk-service stop return code.\n  * Use correct CA for Report DB (bsc#1260806)\n  * Do not call podman healthcheck run to wait for pods to be ready\n    (bsc#1266012)\n\n\nThe following packages are underlying build dependencies\nand system components used by the containers:\n\n\ncobbler:\n\n- Added the distro signature for rhel10 (bsc#1265134)\n\nliberate-formula:\n\n- Version 0.1.4\n  * No customer facing changes\n- Version 0.1.3\n  * Liberate formula support for EL10 (bsc#1265975)\n\nprometheus-exporters-formula:\n\n- Version 1.4.3\n  * Added support for Python 3.13\n  * Drop migrate_formula_data script as it is obsolete\n\nprometheus-postgres_exporter:\n\n- CVE-2022-21698: Replace github.com/prometheus/client_golang with\n  version 1.11.1 (bsc#1248699)\n\nsaline:\n\n- Update to version 2026.05.18:\n  * Explicitly set port number for Prometheus target\n  * Fixed the issue of using non-vendored tornado with Python 3.11\n\nsalt:\n\n- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)\n\nsaltboot-formula:\n\n- Update to version 1.1.0\n  * When autoselecting saltboot device, ignore cd/dvd (bsc#1259960)\n\nspacecmd:\n\n- Version 5.1.14-0\n  * Update translation strings\n\nspacewalk-backend:\n\n- Version 5.1.17-0\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Kickstart profile for RHEL 8 requires venv-salt-minion\n    instead of salt-minion (bsc#1259474)\n  * security(checksums): drop md5 and sha1 from checksum choices (bsc#1234567)\n  * Use PBKDF2-SHA256 (600000 iterations) for new\n    password hashes; verify legacy SHA-256 crypt(3)\n    hashes transparently\n\nspacewalk-java:\n\n- Version 5.1.28-0\n  * Check access rights on two formula API calls (bsc#1269253)\n  * Sanitize uploaded image name (bsc#1269534)\n- Version 5.1.26-0\n  * Added listMigrationTargetsWithChannels endpoint to return\n    the valid migration targets channels (jsc#SUMA-320)\n  * Fixed CSV export failure on system Details \u003e Custom Info page\n  * Added support for migration from SLES 15 to SLES 16\n  * Minor UI improvements and fixed spinning icon glitch\n    in Admin → Setup Wizard\n  * Updated the tab label for eligible subscription\n    systems (bsc#1249243)\n  * Fixed missing field labels in the Create User form.\n    (bsc#1259591)\n  * Enhance buttons readability and consistency across the product\n  * Fixed missing translations (bsc#1259787)\n  * Fixed hub SCC forwarding registration credential filter\n    (bsc#1260031)\n  * Sanitize inputs to avoid injection in rhn_conf\n    of http proxy settings inputs (bsc#1245107)\n  * Move Salt \u003e Remote Commands to its own RBAC namespace\n    (bsc#1261305)\n  * Make OIDC JWKS initialization startup-safe\n  * Sync package removal permissions in packages API with the Web UI\n    (bsc#1261327)\n  * Run ANALYZE asynchronously after CLM alignment to avoid\n    deadlocks (bsc#1261753)\n  * Fixed enforcement of consecutive chars in password policy\n    (bsc#1262761)\n  * Use salt's network module if host or nslookup are not installed\n    (bsc#1262720)\n  * Fixed Remote Commands hang on direct hostname (bsc#1226578)\n  * Fixed Python SyntaxWarning for invalid escape sequence '\\s' in\n    RHUI extract repo data script (bsc#1262595)\n  * Added 'unpushed' to AdvisoryStatus enum to handle EPEL errata\n    with unpushed status (bsc#1264234)\n  * Kickstart profile for RHEL 8 requires venv-salt-minion\n    instead of salt-minion (bsc#1259474)\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Remove validation of packages in kickstart profiles which are\n    not supported anymore (bsc#1259474)\n  * Numeric branch names should not be stored in double format\n    (bsc#1258382)\n  * Added missing pxeeventfailed notification message\n  * Do not add non-FQDN hostnames to the proxy fqdn list\n    (bsc#1263841)\n  * Use supscription matcher output for subscription expiration\n    warning (bsc#1257894)\n  * Fixed Oval data sync for ubuntu 26.04 (bsc#1265319)\n  * Recognize PBKDF2-SHA256 hashes alongside legacy\n    SHA-256 crypt(3) in the Java password check helpers\n  * security(saml2): default signature algorithm to rsa-sha256 (bsc#1234567)\n  * security(tls): remove TLSv1/TLSv1.1, allow TLSv1.3 for SMTP (bsc#1234567)\n  * Fixed CSRFTokenValidator FIPS compatibility by using\n    platform-default SecureRandom (bsc#1247707)\n  * Fixed conflicting cobbler system migrations\n\nspacewalk-web:\n\n- Version 5.1.21-0\n  * UI changes to support migration from SLES 15 to SLES 16\n  * Fixed issue causing a blank tab to appear in the\n    Image Building Details page (bsc#1253032)\n  * Minor UI improvements and fixed spinning icon glitch\n    in Admin → Setup Wizard\n  * Fixed an issue where the 'Create Token' modal could\n    become unresponsive when opened\n  * Fixed an issue causing all existing tokens to be\n    deleted in a loop\n  * Improved visibility of all parent rows in permissions table\n  * Enhance buttons placement for a more intuitive experience\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Align subscription matching page warning with dashboard\n    warning for expiring subscriptions (bsc#1257894)\n  * Added missing fragment import (bsc#1264966)\n\nsubscription-matcher:\n\n- Version 0.44\n  * Fixed 2 missing part numbers (bsc#1264256)\n\nsusemanager:\n\n- Version 5.1.17-0\n  * Added SUSE LibertyLinux 9.6 x86_64 bootstrap repository definition\n  * Removed spacewalk-diskcheck enablement\n  * Use correct CA for Report DB (bsc#1260806)\n  * Relicensed mgr-salt-ssh under Apache-2.0 and move it\n    to a separated package named susemanager-tools-salt\n\nsusemanager-build-keys:\n\n- Added Nvidia Cuda Tools key\n  Added: nvidia-cudatools-9CD0A493D42D0685.asc\n\nsusemanager-docs_en:\n\n- Updated the supported features table in the Client Configuration\n  Guide to include Red Hat Linux Enterprise 10 and clones\n- Added documentation on space usage percentage on the server and db\n  container which can be set using DISKCHECKALERT and DISKTHRESHOLD\n- Added Code 16 to Monitoring documentation (bsc#1263814)\n- Added documentation for deleting SCAP scan results to Administration\n  Guide (bsc#1262471)\n- Rephrased instructions for RBAC in Administration Guide (bsc#1258079)\n- Added troubleshooting section for BTRFS to Administration\n  Guide (bcs#1258816)\n- Removed mentions of Leap 15.5 and 15.4 and specified SUSE requiring\n  general or LTS support in Client Configuration Guide (bsc#1262285)\n- Added information about availability of SLE 16 and SL Micro 6.2\n  support in the product versions 5.1.2 and later (bsc#1260614)\n- Removed mention of CIS profile (bsc#1262460)\n- Corrected path for Salt minion in Retail Guide (#1262090)\n- Added explanation for translating mgradm arguments to YAML in\n  Installation and Upgrade Guide (bsc#1258144)\n- Removed Google Cloud Compute from PAYG documentation (bsc#1261631)\n- Added link to proxy creation from client to an existing document in\n  Installation and Upgrade Guide\n- Updated features table for EL 10 based distributions\n- Document Debian 13\n- Added support for Open Enterprise Server 25.4\n- Clarified how to get PTF images in air-gapped setup in Installation\n  and Upgrade Guide (bsc#1261307)\n- SUSE Multi-Linux Support does not support autoinstallation\n  (bsc#1259261)\n- Added instructions about accessing git repositories when building\n  images to Administration Guide\n- Added online database backup instructions to Administration Guide\n- Fixed comamnd for product deployment in Installation and Upgrade\n  Guide (bsc#1259479)\n- Added online database backup instructions\n\nsusemanager-schema:\n\n- Version 5.1.19-0\n  * Added the RBAC mapping for listMigrationTargetsWithChannels\n    end point (jsc#SUMA-320)\n  * Added index on rhnPackage (checksum_id) (bsc#1258041)\n  * Move Salt \u003e Remote Commands to its own RBAC namespace\n    (bsc#1261305)\n  * Sync package removal permissions in packages API with the Web UI\n    (bsc#1261327)\n  * Added 'unpushed' to rhn_errata_adv_status_ck constraint to\n    allow importing EPEL errata with unpushed status (bsc#1264234)\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Added missing indexes for channels and tokens (bsc#1259590)\n  * Increase source_url on table rhncontentsource (bsc#1259230)\n\nsusemanager-sls:\n\n- Version 5.1.25-0\n  * Added salt states to support migration from SLES 15 to SLES 16\n  * Ignore podman interfaces when resolving FQDNs (bsc#1262720)\n  * Fixed GPG key import on first key deploy (bsc#1259482)\n  * Use either ansible-core or ansible packages\n    for Ansible Control node, prefer ansible-core (bsc#1259087)\n  * Fixed CPU reporting for ppc64le clients (bsc#1259521)\n  * Fixed refresh of virtual instance information (bsc#1261723)\n\nsusemanager-sync-data:\n\n- Version 5.1.10-0\n  * Added missing RES-EMS channel family (bsc#1265358)\n- Version 5.1.9-0\n  * Added SUSE Liberty Linux 9.6 x86_64 product entries\n\nuyuni-common-libs:\n\n- Version 5.1.6-0\n  * security(checksums): drop md5 and sha1 from checksum choices (bsc#1234567)\n  * Replaced deprecated inspect.getargspec with EAFP usedforsecurity detection\n\nuyuni-reportdb-schema:\n\n- version 5.1.7-0\n  * Increased url on table repository (bsc#1259230)\n\nuyuni-setup-reportdb:\n\n- Version 5.1.5-0\n  * Fixed delete of a reportdb user with uyuni-setup-reportdb-user\n    (bsc#1261841)\n\n\nvirtual-host-gatherer:\n\n- Version 1.0.31-0\n  * Dropped SUSECloud module as not longer maintainednor used\n- Version 1.0.30-0\n  * No customer facing changes\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Multi-Linux Manager Server.\n2. Upgrade mgradm and mgrctl.\n3. If you are in a disconnected environment, upgrade the image packages.\n4. Reboot the system.\n5. Run `mgradm upgrade podman` which will use the default image tags.\n","status":"published","published":"2026-07-06T07:52:25Z","modified":"2026-07-07T08:30:06.278184108Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}