pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
Priority MEDIUM 42CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Partial Red Hat: 6 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.
Summary
pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Partial pgjdbc (pgjdbc): 42.7.7org.postgresql:postgresql (Maven): 42.7.7Red Hat: 6 advisoriesRed Hat: 6 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PostgreSQL | pgjdbc | 42.7.4 to before 42.7.7 | 42.7.7 | Patch available | CNA |
| — | org.postgresql:postgresql (Maven) | 42.7.4 to before 42.7.7 | 42.7.7 | Patch available | GHSA-hq9p-pm7w-8p54 |
- pgjdbc VendorPostgreSQL Affected 42.7.4 to before 42.7.7 Fixed in 42.7.7 Patch available CNA
- org.postgresql:postgresql (Maven) Vendor— Affected 42.7.4 to before 42.7.7 Fixed in 42.7.7 Patch available GHSA-hq9p-pm7w-8p54
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* | 42.7.4 to before 42.7.7 | Vulnerable | PostgreSQL |
- cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions 42.7.4 to before 42.7.7 Vulnerable ·PostgreSQL
Remediation
- Fix · CNA pgjdbc (pgjdbc) Fixed in 42.7.7
- Fix · GHSA-hq9p-pm7w-8p54 org.postgresql:postgresql (Maven) Fixed in 42.7.7 Advisory →
Red Hat 6 advisories
- RHSA-2025:16409 Released 2025-09-22 · Red Hat rating ImportantRed Hat AMQ Broker 7.12.5 release and security update
- Red Hat AMQ Broker 7.12.5
- RHSA-2025:13010 Released 2025-08-07 · Red Hat rating ImportantRed Hat build of Quarkus 3.20.2 release and security update
- Red Hat build of Quarkus 3.20.2.redhat io.quarkus.quarkus-vertx-3.20.2.redhat-00003.jar, org.postgresql.postgresql-42.7.7.redhat-00001.jar
- RHSA-2025:13012 Released 2025-08-07 · Red Hat rating ImportantRed Hat build of Quarkus 3.15.6 release and security update
- Red Hat build of Quarkus 3.15.6
Show 3 more Red Hat advisories
- RHSA-2025:13274 Released 2025-08-06 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.1 release and security update
- Red Hat AMQ Broker 7.13.1
- RHSA-2025:10323 Released 2025-07-03 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-db-rhel9, cryostat/cryostat-grafana-dashboard-rhel9 +8
- RHSA-2025:9697 Released 2025-06-25 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.10.3 for Spring Boot patch release.
- Red Hat build of Apache Camel 4.10.3 for Spring Boot 3.4.7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2025:10323 |
| Red Hat AMQ Broker 7.12.5 | Fixed | RHSA-2025:16409 |
| Red Hat AMQ Broker 7.13.1 | Fixed | RHSA-2025:13274 |
| Red Hat build of Apache Camel 4.10.3 for Spring Boot 3.4.7 | Fixed | RHSA-2025:9697 |
| Red Hat build of Quarkus 3.15.6 | Fixed | RHSA-2025:13012 |
| Red Hat build of Quarkus 3.20.2.redhat | Fixed | RHSA-2025:13010 |
Not affected: 15 products
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 8
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Dev Spaces
- Red Hat Process Automation 7
- Red Hat Satellite 6
- Red Hat Single Sign-On 7
- Red Hat build of Debezium 2
- Red Hat build of Debezium 3
- Red Hat build of OptaPlanner 8
- Red Hat build of Quarkus 3.20.2.redhat
Timeline
- 2026-10-02 Threatist record created from CVE-2025-49146
- 2026-10-03 Alias added: GHSA-hq9p-pm7w-8p54
- 2026-10-20 Fix available: Red Hat build of Quarkus 3.20.2.redhat · Red Hat
References
Advisory 2
More Postgresql Jdbc Driver vulnerabilities
- TI-2024-01491 pgjdbc SQL Injection via line comment generation CVSS 3.1CRITICAL 10.0
- TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
- TI-2022-13237 SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc CVSS 3.1HIGH 8.0
- TI-2022-09860 In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call… CVSS 3.1CRITICAL 9.8
- TI-2026-30519 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS CVSS 3.1HIGH 7.5
- TI-2020-10739 PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. CVSS 3.1HIGH 7.7
Sources
- CVE-2025-49146 · CVE Program
- CVE-2025-49146 · NVD
- FIRST EPSS
- GHSA-hq9p-pm7w-8p54 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-49146 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences