Read the docs
TI-2026-30519 Aliases CVE-2026-42198GHSA-98qh-xjc8-98pq

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

Priority MEDIUM 45CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 16 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03261 88th percentileScored 2026-11-07
Fix Partial pgjdbc (pgjdbc): 42.7.11org.postgresql:postgresql (Maven): 42.7.11Red Hat: 13 advisoriesRed Hat: 16 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PostgreSQLpgjdbc42.2.0 to before 42.7.1142.7.11Patch availableCNA
—org.postgresql:postgresql (Maven)42.2.0 to before 42.7.1142.7.11Patch availableGHSA-98qh-xjc8-98pq
  • pgjdbc VendorPostgreSQL Affected 42.2.0 to before 42.7.11 Fixed in 42.7.11 Patch available CNA
  • org.postgresql:postgresql (Maven) Vendor— Affected 42.2.0 to before 42.7.11 Fixed in 42.7.11 Patch available GHSA-98qh-xjc8-98pq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*42.2.0 to before 42.7.11VulnerablePostgreSQL
  • cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions 42.2.0 to before 42.7.11 Vulnerable ·PostgreSQL

Remediation

  • Fix · CNA pgjdbc (pgjdbc) Fixed in 42.7.11
  • Fix · GHSA-98qh-xjc8-98pq org.postgresql:postgresql (Maven) Fixed in 42.7.11 Advisory →

Red Hat 13 advisories

  • RHSA-2026:66545 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.6 release and security update
    • Red Hat AMQ Broker 7.13.6
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:59277 Released 2026-08-25 · Red Hat rating Important
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) postgresql-jdbc-42.2.3-5.el8_6.1, postgresql-jdbc-javadoc-42.2.3-5.el8_6.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) postgresql-jdbc-42.2.3-5.el8_6.1, postgresql-jdbc-javadoc-42.2.3-5.el8_6.1
Show 10 more Red Hat advisories
  • RHSA-2026:59278 Released 2026-08-25 · Red Hat rating Important
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) postgresql-jdbc-42.2.3-7.el8_4.1, postgresql-jdbc-javadoc-42.2.3-7.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) postgresql-jdbc-42.2.3-7.el8_4.1, postgresql-jdbc-javadoc-42.2.3-7.el8_4.1
  • RHSA-2026:54532 Released 2026-08-13 · Red Hat rating Important
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) postgresql-jdbc-42.2.28-1.el9_2.1
  • RHSA-2026:52978 Released 2026-08-10 · Red Hat rating Important
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) postgresql-jdbc-42.2.14-5.el8_8.1, postgresql-jdbc-javadoc-42.2.14-5.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) postgresql-jdbc-42.2.14-5.el8_8.1, postgresql-jdbc-javadoc-42.2.14-5.el8_8.1
  • RHSA-2026:52930 Released 2026-08-10 · Red Hat rating Important
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) postgresql-jdbc-42.2.28-1.el9_6.1
  • RHSA-2026:52929 Released 2026-08-10 · Red Hat rating Important
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) postgresql-jdbc-42.2.28-1.el9_4.1
  • RHSA-2026:52928 Released 2026-08-10 · Red Hat rating Important
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) postgresql-jdbc-42.7.1-7.el10_0.1
  • RHSA-2026:25030 Released 2026-06-10 · Red Hat rating Important
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream (v. 8) postgresql-jdbc-42.2.14-4.el8_10, postgresql-jdbc-javadoc-42.2.14-4.el8_10
  • RHSA-2026:24348 Released 2026-06-08 · Red Hat rating Important
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream (v. 10) postgresql-jdbc-42.7.2-1.el10_2.2
  • RHSA-2026:22304 Released 2026-06-01 · Red Hat rating Important
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-jdbc-42.2.28-2.el9_8.2
  • RHSA-2026:19098 Released 2026-05-20 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.3.SP2 security update
    • Red Hat build of Quarkus 3.27.3.SP2 org.postgresql.postgresql-42.7.11.redhat-00001.jar

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat AMQ Broker 7.13.6Fixed RHSA-2026:66545
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:24348
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:25030
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:22304
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:59278
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:59277
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:52978
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:54532
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:52929
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:52928
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:52930
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:59278
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:59277
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:52978
Red Hat build of Quarkus 3.27.3.SP2Fixed RHSA-2026:19098
Not affected: 2 products
  • Red Hat Enterprise Linux 7
  • Red Hat build of Quarkus 3.27.3.SP2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42198
  2. 2026-10-03 Alias added: GHSA-98qh-xjc8-98pq
  3. 2026-10-16 EPSS moved to the 50th–90th percentile
  4. 2026-10-20 Affected versions changed · Red Hat

References

Advisory 2

Other 2

  • TI-2024-01491 pgjdbc SQL Injection via line comment generation CVSS 3.1CRITICAL 10.0
  • TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
  • TI-2022-13237 SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc CVSS 3.1HIGH 8.0
  • TI-2022-09860 In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call… CVSS 3.1CRITICAL 9.8
  • TI-2025-31226 pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration CVSS 3.1HIGH 8.2
  • TI-2020-10739 PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. CVSS 3.1HIGH 7.7
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences