CVE-2026-42198: PostgreSQL pgjdbc denial of service via unbounded SCRAM iterations

CVE-2026-42198 · Severity: high · CVSS 7.5 · Published 2026-04-29

The PostgreSQL JDBC Driver (pgjdbc), a library used by Java applications to connect to PostgreSQL databases, is vulnerable to a denial-of-service attack. A malicious or compromised database server can force the connecting application to perform extremely intensive calculations during the login process, exhausting the application's CPU resources. This can lead to application crashes, service outages, and the inability for legitimate users to connect to the database.

Technologies: org.postgresql:postgresql (Maven), Red Hat Enterprise Linux AppStream. Vendors: Maven, PostgreSQL, Red Hat.

Quick answers

Is CVE-2026-42198 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42198 being exploited in the wild.
How severe is CVE-2026-42198?
High severity, with a CVSS score of 7.5, published 29 April 2026.
Which products and versions are affected?
org.postgresql:postgresql (Maven) ECOSYSTEM:introduced=42.2.0,fixed=42.7.11; PostgreSQL Global Development Group Pgjdbc >= 42.2.0, < 42.7.11.
Is there a fix for CVE-2026-42198?
Yes. org.postgresql:postgresql (Maven): upgrade to 42.7.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42198 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42198?
Check whether you run org.postgresql:postgresql (Maven), Postgresql Jdbc Driver, PostgreSQL Global Development Group Pgjdbc or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.postgresql:postgresql (Maven): upgrade to 42.7.11 or later
    # set org.postgresql:postgresql to 42.7.11 in your pom.xml or build.gradle

Technical details

The vulnerability is a resource exhaustion issue (CWE-770) within the SCRAM-SHA-256 authentication implementation of pgjdbc. When a client attempts to authenticate, a malicious server can return a 'server-first-message' containing an arbitrarily large iteration count for the PBKDF2 function. The driver fails to validate or cap this value before beginning computation, leading to unbounded CPU usage. Notably, the 'loginTimeout' property does not mitigate this, as the worker thread continues the calculation even after the caller times out. The fix, introduced in version 42.7.11, adds a 'scramMaxIterations' property (defaulting to 100,000) to reject excessive iteration counts before processing.

Affected products

  • PostgreSQL pgjdbc >= 42.2.0, < 42.7.11
  • Red Hat Red Hat Enterprise Linux AppStream (v. 8, 9, 10)
  • Red Hat Red Hat build of Quarkus 3.27.3.SP2

Identifiers

  • CVE-2026-42198
  • GHSA-98qh-xjc8-98pq

Timeline

  • 2026-04-28: patched: Version 42.7.11 released with fix
  • 2026-04-28: advisory: GitHub Security Advisory GHSA-98qh-xjc8-98pq published
  • 2026-04-29: disclosed: CVE-2026-42198 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.