{"id":"CVE-2026-54291","aliases":["BIT-postgresql-jdbc-driver-2026-54291","DEBIAN-CVE-2026-54291","EUVD-2026-41903","GHSA-j92g-9f8w-j867","ROOT-APP-MAVEN-CVE-2026-54291","UBUNTU-CVE-2026-54291"],"status":"published","title":"Silent channel-binding authentication downgrade via unsupported certificate algorithms","description":"pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00236,"percentile":0.14769,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-636","CWE-757"],"published":"2026-07-06T18:55:01Z","modified":"2026-11-04T20:04:19Z","fixes":[{"ecosystem":"Maven","package":"org.postgresql:postgresql","fixed_in":["42.7.12"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"postgresql-jdbc-driver","fixed_in":["42.7.12"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpgjava","fixed_in":["42.7.12-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.postgresql:postgresql","fixed_in":["42.7.10-aikido.1","42.7.11-aikido.1","42.7.7-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.postgresql:postgresql","fixed_in":["42.7.10-root.io.1","42.7.11-root.io.1","42.7.7-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.7.4"},{"fixed":"42.7.12"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"postgresql-jdbc-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"42.7.4"},{"fixed":"42.7.12"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.5.4-1","42.5.5-0+deb12u1","42.6.0-1","42.6.0-2","42.7.0-1","42.7.1-1","42.7.10-1","42.7.11-1","42.7.12-1","42.7.13-1","42.7.2-1","42.7.3-1","42.7.3-2","42.7.5-1","42.7.5-2","42.7.6-1","42.7.7-1","42.7.7-2","42.7.8-1","42.7.8-2","42.7.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.7.10-1","42.7.11-1","42.7.12-1","42.7.13-1","42.7.7-1","42.7.7-2","42.7.8-1","42.7.8-2","42.7.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.12-1"}]}],"versions":["42.7.10-1","42.7.11-1","42.7.7-1","42.7.7-2","42.7.8-1","42.7.8-2","42.7.9-1"]},{"source":"osv","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.7.4"},{"fixed":"42.7.12"}]}],"versions":["42.7.10","42.7.11","42.7.4","42.7.5","42.7.6","42.7.7","42.7.8","42.7.9"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.10-aikido.1"},{"fixed":"42.7.11-aikido.1"},{"fixed":"42.7.7-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.10-root.io.1"},{"fixed":"42.7.11-root.io.1"},{"fixed":"42.7.7-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.7.5-1","42.7.5-2","42.7.7-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.7.10-1","42.7.11-1","42.7.12-1","42.7.13-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.7.7-1","42.7.8-1","42.7.8-2","42.7.9-1","42.7.10-1"]}],"products":[{"vendor":"pgjdbc","product":"pgjdbc"},{"vendor":"postgresql","product":"postgresql_jdbc_driver"}],"references":[{"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/ongres/scram/releases/tag/3.3","tags":["x_refsource_MISC","Not Applicable","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54291","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-j92g-9f8w-j867"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54291.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54291","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-54291","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54291","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-54291","title":"Silent channel-binding authentication downgrade via unsupported certificate algorithms","description":"pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.","status":"published","published":"2026-07-06T18:55:01.675Z","modified":"2026-07-06T19:47:17.454Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-636","CWE-757"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-41903","description":"pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.","status":"published","published":"2026-07-06T18:55:01Z","modified":"2026-07-06T19:47:17Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","level":"high"}],"updated_at":"2026-11-02T18:20:12.41351Z"}],"ghsa":[{"id":"GHSA-j92g-9f8w-j867","title":"PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms","description":"### Impact\n\n`channelBinding=require` connections can be silently downgraded from `SCRAM-SHA-256-PLUS` (with channel binding) to plain `SCRAM-SHA-256` (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no `tls-server-end-point` channel-binding hash. Examples are `Ed25519`, `Ed448`, and post-quantum algorithms.\n\nTwo issues combine in releases 42.7.4 through 42.7.11:\n\n1. The bundled `com.ongres.scram:scram-client` (3.1 or 3.2) returns an empty byte array instead of failing when it cannot derive the binding hash for such a certificate. This is the library issue tracked as [GHSA-p9jg-fcr6-3mhf](https://github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf).\n2. pgJDBC does not enforce `channelBinding=require` where it matters. `ScramAuthenticator` checks only that the server *advertised* a `-PLUS` mechanism; it neither rejects the empty binding nor checks that the *negotiated* mechanism uses channel binding. The connection therefore downgrades silently, and would do so even against a fixed `scram-client`, because the missing enforcement is in pgJDBC's own code.\n\nOnly connections that set `channelBinding=require` are affected. Under the default `prefer` policy, and under `allow` or `disable`, falling back to plain SCRAM is the documented behaviour. Releases before 42.7.4 are unaffected, because they do not support channel binding.\n\n### Patches\n\nFixed in pgJDBC 42.7.12. pgJDBC now enforces channel binding in its own code, independently of the `scram-client` version:\n\n- Under `channelBinding=require`, it fails the connection when no channel-binding data can be extracted from the server certificate, instead of passing an empty value to the SCRAM client. The error names the certificate signature algorithm.\n- After negotiation, it requires the selected mechanism to use channel binding (a `-PLUS` mechanism) whenever `channelBinding=require` is set, regardless of how negotiation resolved.\n\nUpgrade to 42.7.12 or later.\n\n### Workarounds\n\nNo pgJDBC setting restores channel-binding enforcement on an affected release; upgrading is the fix.\n\nIf you cannot upgrade immediately, verify the server certificate at the TLS layer so that a man-in-the-middle cannot present a substitute certificate. Set `sslmode=verify-full` with a truststore that contains only your server's CA. This defence is independent of channel binding and blocks the same attacker. Connections that rely on `channelBinding=require` in place of certificate verification have no equivalent workaround and should upgrade.\n\n### References\n\n-  [GHSA-p9jg-fcr6-3mhf](https://github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf) — the related `com.ongres.scram:scram-client` issue (root cause of the empty channel-binding value).\n- `scram-client` 3.3 release (library fix): https://github.com/ongres/scram/releases/tag/3.3\n- pgJDBC fix in 42.7.12: [commit](https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99)","status":"published","published":"2026-07-21T17:47:39Z","modified":"2026-07-21T17:47:40Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","level":"high"}],"cwes":["CWE-636","CWE-757"],"updated_at":"2026-11-02T14:40:50.444681Z"}],"nvd":[{"id":"CVE-2026-54291","description":"pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.","status":"published","published":"2026-07-06T19:17:08.407Z","modified":"2026-07-09T13:16:25.717Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-636","CWE-757"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"CVE-2026-54291","title":"Silent channel-binding authentication downgrade via unsupported certificate algorithms","description":"pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.","status":"published","published":"2026-07-06T18:55:01.675Z","modified":"2026-10-28T11:14:38.387060122Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","level":"high"}],"cwes":["CWE-636","CWE-757"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"DEBIAN-CVE-2026-54291","description":"pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.","status":"published","published":"2026-07-06T19:17:08.407Z","modified":"2026-10-01T03:03:26.85914549Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-j92g-9f8w-j867","title":"PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms","description":"### Impact\n\n`channelBinding=require` connections can be silently downgraded from `SCRAM-SHA-256-PLUS` (with channel binding) to plain `SCRAM-SHA-256` (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no `tls-server-end-point` channel-binding hash. Examples are `Ed25519`, `Ed448`, and post-quantum algorithms.\n\nTwo issues combine in releases 42.7.4 through 42.7.11:\n\n1. The bundled `com.ongres.scram:scram-client` (3.1 or 3.2) returns an empty byte array instead of failing when it cannot derive the binding hash for such a certificate. This is the library issue tracked as [GHSA-p9jg-fcr6-3mhf](https://github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf).\n2. pgJDBC does not enforce `channelBinding=require` where it matters. `ScramAuthenticator` checks only that the server *advertised* a `-PLUS` mechanism; it neither rejects the empty binding nor checks that the *negotiated* mechanism uses channel binding. The connection therefore downgrades silently, and would do so even against a fixed `scram-client`, because the missing enforcement is in pgJDBC's own code.\n\nOnly connections that set `channelBinding=require` are affected. Under the default `prefer` policy, and under `allow` or `disable`, falling back to plain SCRAM is the documented behaviour. Releases before 42.7.4 are unaffected, because they do not support channel binding.\n\n### Patches\n\nFixed in pgJDBC 42.7.12. pgJDBC now enforces channel binding in its own code, independently of the `scram-client` version:\n\n- Under `channelBinding=require`, it fails the connection when no channel-binding data can be extracted from the server certificate, instead of passing an empty value to the SCRAM client. The error names the certificate signature algorithm.\n- After negotiation, it requires the selected mechanism to use channel binding (a `-PLUS` mechanism) whenever `channelBinding=require` is set, regardless of how negotiation resolved.\n\nUpgrade to 42.7.12 or later.\n\n### Workarounds\n\nNo pgJDBC setting restores channel-binding enforcement on an affected release; upgrading is the fix.\n\nIf you cannot upgrade immediately, verify the server certificate at the TLS layer so that a man-in-the-middle cannot present a substitute certificate. Set `sslmode=verify-full` with a truststore that contains only your server's CA. This defence is independent of channel binding and blocks the same attacker. Connections that rely on `channelBinding=require` in place of certificate verification have no equivalent workaround and should upgrade.\n\n### References\n\n-  [GHSA-p9jg-fcr6-3mhf](https://github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf) — the related `com.ongres.scram:scram-client` issue (root cause of the empty channel-binding value).\n- `scram-client` 3.3 release (library fix): https://github.com/ongres/scram/releases/tag/3.3\n- pgJDBC fix in 42.7.12: [commit](https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99)","status":"published","published":"2026-07-21T17:47:39Z","modified":"2026-09-10T03:50:12.377062079Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","level":"high"}],"cwes":["CWE-636","CWE-757"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"UBUNTU-CVE-2026-54291","description":"pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.","status":"published","published":"2026-07-06T19:17:00Z","modified":"2026-11-04T20:04:19.265128622Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-04T21:43:41.994988Z"},{"id":"BIT-postgresql-jdbc-driver-2026-54291","title":"Silent channel-binding authentication downgrade via unsupported certificate algorithms","description":"pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.","status":"published","published":"2026-07-12T23:50:28.176Z","modified":"2026-09-08T08:48:24.727586531Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-54291","title":"CVE-2026-54291 in org.postgresql:postgresql - Patched by Root","description":"Root has patched CVE-2026-54291 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-23T11:06:47Z","modified":"2026-09-23T12:15:03.371264757Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}