Executive brief
A security flaw in the PostgreSQL Java database driver (pgJDBC) allows an attacker to bypass mandatory security protections during the login process. When a connection is configured to require 'channel binding'—a feature designed to prevent man-in-the-middle attacks—the driver may silently downgrade to a less secure authentication method if it encounters certain types of security certificates. This could allow an attacker who can intercept network traffic to impersonate the database server or capture sensitive authentication data.
Technical details
The PostgreSQL JDBC Driver (pgJDBC) is vulnerable to a silent authentication downgrade from SCRAM-SHA-256-PLUS to SCRAM-SHA-256. This occurs because the ScramAuthenticator component fails to verify that the negotiated authentication mechanism actually uses channel binding, even when 'channelBinding=require' is set. Additionally, the bundled 'scram-client' library returns an empty byte array when encountering unsupported certificate signature algorithms (like Ed25519 or post-quantum algorithms) instead of throwing an error. An attacker capable of intercepting the TLS connection can present such a certificate to trigger the downgrade and bypass man-in-the-middle protections. The issue is fixed in version 42.7.12 by enforcing channel binding checks within the driver's own logic.
Affected products
- PostgreSQL postgresql-jdbc-driver >= 42.7.4, < 42.7.12
Timeline
- 2026-06-29: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched: Fixed in version 42.7.12