CVE-2026-42198: PostgreSQL JDBC Driver Unbounded PBKDF2 Iterations in SCRAM Authentication Leading to CPU Exhaustion DoS
Summary
CVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS. Affects postgresql-jdbc-driver versions >= 42.2.0, < 42.7.11. Fixed in 42.7.11. How to fix ↓
Also tracked for
- org.postgresql:postgresql · Maven
The same CVE-2026-42198 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The PostgreSQL JDBC Driver, known as pgjdbc, is an open-source library that enables Java applications to interact with PostgreSQL databases. It provides essential functionalities such as connection management, query execution, and transaction handling. However, certain versions of pgjdbc are vulnerable to a denial of service (DoS) attack during SCRAM-SHA-256 authentication, which can lead to significant performance degradation.
Vulnerability Detail
The vulnerability arises from the ability of a malicious server to instruct the pgjdbc driver to perform SCRAM authentication with an excessively high iteration count in the PBKDF2 function. This can cause the client to consume an unbounded amount of CPU resources, effectively leading to a denial of service. Each authentication attempt can monopolize a CPU core, and repeated attempts can exhaust the client's CPU resources, potentially causing connection pools to become unresponsive. The issue is exacerbated by the fact that the loginTimeout setting does not fully mitigate the problem, as the worker thread may continue to consume CPU time even after the timeout expires.
How To Fix
Minimum fixed version
42.7.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a rate-limiting mechanism on the client side to limit the number of authentication attempts made to the server. This can help mitigate the impact of potential DoS attacks until the package is updated. Additionally, consider monitoring your application's CPU usage and implementing alerts for unusual spikes.
Conclusion
The CVE-2026-42198 vulnerability in the PostgreSQL JDBC Driver poses a significant risk of denial of service due to unbounded CPU consumption during SCRAM authentication. Users are strongly advised to update to the patched version 42.7.11 to mitigate this issue. Implementing rate limiting can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for postgresql-jdbc-driver →
FAQ
CVE-2026-42198 is a vulnerability in the PostgreSQL JDBC Driver that allows a malicious server to cause CPU exhaustion on the client during SCRAM-SHA-256 authentication.
Versions from 42.2.0 to before 42.7.11 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The vulnerability can lead to a denial of service, where the client application may become unresponsive due to excessive CPU usage during authentication attempts.
Yes, the vulnerability has been patched in version 42.7.11 of the PostgreSQL JDBC Driver. It is recommended to update to this version or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc-driver.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
