Junglewise Threat Intelligence

CVE-2026-42198: PostgreSQL pgjdbc denial of service via unbounded SCRAM iterations

CVE-2026-42198 · Severity: high · CVSS 7.5 · Published 2026-04-29

Technologies: Red Hat Enterprise Linux AppStream, org.postgresql:postgresql (Maven). Vendors: Red Hat, Maven, PostgreSQL.

Executive brief

The PostgreSQL JDBC Driver (pgjdbc), a library used by Java applications to connect to PostgreSQL databases, is vulnerable to a denial-of-service attack. A malicious or compromised database server can force the connecting application to perform extremely intensive calculations during the login process, exhausting the application's CPU resources. This can lead to application crashes, service outages, and the inability for legitimate users to connect to the database.

Technical details

The vulnerability is a resource exhaustion issue (CWE-770) within the SCRAM-SHA-256 authentication implementation of pgjdbc. When a client attempts to authenticate, a malicious server can return a 'server-first-message' containing an arbitrarily large iteration count for the PBKDF2 function. The driver fails to validate or cap this value before beginning computation, leading to unbounded CPU usage. Notably, the 'loginTimeout' property does not mitigate this, as the worker thread continues the calculation even after the caller times out. The fix, introduced in version 42.7.11, adds a 'scramMaxIterations' property (defaulting to 100,000) to reject excessive iteration counts before processing.

Affected products

  • PostgreSQL pgjdbc >= 42.2.0, < 42.7.11
  • Red Hat Red Hat Enterprise Linux AppStream (v. 8, 9, 10)
  • Red Hat Red Hat build of Quarkus 3.27.3.SP2

Timeline

  • 2026-04-28: patched: Version 42.7.11 released with fix
  • 2026-04-28: advisory: GitHub Security Advisory GHSA-98qh-xjc8-98pq published
  • 2026-04-29: disclosed: CVE-2026-42198 published to NVD

References

Related threats