Log in Start free

Vulnerability · Published Apr 29, 2026 · Assigned by GitHub_M

CVE-2026-42198pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

High 7.5

In plain English

A high-severity resource allocation without limits in pgjdbc from pgjdbc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.3%top 11.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10postgresql-jdbc42.7.2-1.el10_2.2ALSA-2026:24348
AlmaLinux:8postgresql-jdbc42.2.14-4.el8_10ALSA-2026:25030
AlmaLinux:9postgresql-jdbc42.2.28-2.el9_8.2ALSA-2026:22304
AlmaLinux:8postgresql-jdbc-javadoc42.2.14-4.el8_10ALSA-2026:25030
Debian:12libpgjavano fix listedDEBIAN-CVE-2026-42198
Debian:13libpgjavano fix listedDEBIAN-CVE-2026-42198
Debian:14libpgjava42.7.11-1DEBIAN-CVE-2026-42198
Mavenorg.postgresql:postgresql42.7.11GHSA-98qh-xjc8-98pq
Rocky Linux:10postgresql-jdbc0:42.7.2-1.el10_2.2RLSA-2026:24348
Rocky Linux:8postgresql-jdbc0:42.2.14-4.el8_10RLSA-2026:25030
Rocky Linux:9postgresql-jdbc0:42.2.28-2.el9_8.2RLSA-2026:22304
Ubuntu:22.04:LTSlibpgjavano fix listedUBUNTU-CVE-2026-42198
Ubuntu:24.04:LTSlibpgjavano fix listedUBUNTU-CVE-2026-42198
Ubuntu:25.10libpgjavano fix listedUBUNTU-CVE-2026-42198
Ubuntu:26.04:LTSlibpgjavano fix listedUBUNTU-CVE-2026-42198
Ubuntu:26.10libpgjavano fix listedUBUNTU-CVE-2026-42198

Affected products (as reported)

VendorProductVersions
pgjdbc pgjdbc >= 42.2.0, < 42.7.11

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References