pgjdbc pads short values with leftover bytes from earlier statements
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-201.
Summary
pgjdbc versions 42.7.4 through 42.7.13 pad a short value with leftover send buffer bytes instead of zeros, and the server stores them. The padding holds earlier messages sent on the same connection, such as SQL text and parameter values, which can come from other requests on pooled connections (CWE-201). An attacker with low privileges who can make the application store such a value and read it back can collect that traffic.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same connection: SQL text and parameter values of recent statements, which on a pooled connection can come from other requests. Each padded value can carry up to 8192 bytes of this traffic, or 16320 bytes on a connection with GSS encryption. The padding happens when an application declares a length larger than the data it supplies, through PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes. The driver accepts these calls without an error. An attacker who can make the application store such a value and read it back can collect earlier traffic. Applications whose declared lengths always match their data are not affected. Versions 42.7.3 and earlier pad with zeros.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PostgreSQL | pgjdbc | 42.7.4 – 42.7.13 | — | No fix listed | CNA |
- pgjdbc VendorPostgreSQL Affected 42.7.4 – 42.7.13 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* | — | — | PostgreSQL |
- cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions — — ·PostgreSQL
Remediation
The sources list no fixed version for pgjdbc. Red Hat lists no available fix for Red Hat AMQ Broker 7, Red Hat Build of Keycloak, Red Hat OpenShift Dev Spaces, Red Hat Satellite 6, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3 and Red Hat build of Quarkus.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Keycloak | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet |
Not affected: 6 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat Hardened Images
- Red Hat OpenStack Platform 13 (Queens)
Timeline
- 2026-10-07 Threatist record created from CVE-2026-107315
- 2026-10-08 CISA SSVC decision points changed
- 2026-10-08 Priority changed: LOW → MEDIUM
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-09 CVSS score added · Red Hat
- 2026-10-29 Affected versions changed · Red Hat
References
More PostgreSQL vulnerabilities
- TI-2024-01491 pgjdbc SQL Injection via line comment generation CVSS 3.1CRITICAL 10.0
- TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
- TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
- TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
- TI-2022-13237 SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc CVSS 3.1HIGH 8.0
- TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
Sources
- CVE-2026-107315 · CVE Program
- CVE-2026-107315 · NVD
- FIRST EPSS
- CVE-2026-107315 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences