TI-2026-69271 Aliases CVE-2026-107313

pgjdbc stores stale buffer bytes in large values over GSS

MEDIUM 53CWE-201Published 2026-10-07 · Updated 2026-10-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-201.

Summary

pgjdbc (PostgreSQL JDBC Driver) versions from 42.7.4 before 42.7.6 can send stale bytes from the GSS send buffer in place of the start of a large value when GSS encryption is on (gssEncMode=prefer or require). The server stores the value without an error, so it holds bytes of earlier messages, such as SQL text, instead of the application's data (CWE-201). With MIT Kerberos, values of 16320 bytes or more are affected. The default gssEncMode=allow is not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos. The stored value then holds bytes of the messages the driver sent just before it on the same connection, such as the statement's SQL text, its other parameters, and earlier rows of the same batch, instead of the bytes the application supplied. Values at least as long as the buffer are affected when the driver writes them from a byte array: bind parameters set with setString, setBytes, or a ByteStreamWriter, CopyIn.writeToCopy, and LargeObject.write. Most such writes fail with an ArrayIndexOutOfBoundsException instead. The default, gssEncMode=allow, does not start GSS encryption, and connections without GSS encryption are not affected. Versions 42.7.3 and earlier are not affected, and 42.7.6 fixes the problem.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00144 3rd percentileScored 2026-11-07

Fix Fixed pgjdbc (pgjdbc): 42.7.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PostgreSQL	pgjdbc	42.7.4 to before 42.7.6	42.7.6	Patch available	CNA

pgjdbc VendorPostgreSQL Affected 42.7.4 to before 42.7.6 Fixed in 42.7.6 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:postgresql:postgresql_jdbc_driver::::::::	—	—	PostgreSQL

cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions — — ·PostgreSQL

Remediation

Upgrade pgjdbc to version 42.7.6, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA pgjdbc (pgjdbc) Fixed in 42.7.6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-07 Threatist record created from CVE-2026-107313
2026-10-07 CISA SSVC decision points changed
2026-10-07 Priority changed: LOW → MEDIUM
2026-10-20 Affected versions changed · Red Hat
2026-10-20 CVSS score added · Red Hat

References

Patch 2

Advisory 1

https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hggc-j2qh-988m

TI-2024-01491 pgjdbc SQL Injection via line comment generation CVSS 3.1CRITICAL 10.0
TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
TI-2022-13237 SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc CVSS 3.1HIGH 8.0
TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8

See all 228 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences