Critical Security Update for PostgreSQL JDBC: Client-side Denial of Service Vulnerability
Summary
ALSA-2026:25030: Important: postgresql-jdbc security update. Affects postgresql-jdbc versions < 42.2.14-4.el8_10. Fixed in 42.2.14-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful object-relational database management system that allows users to manage and manipulate data efficiently. The postgresql-jdbc package provides the necessary .jar files for Java applications to connect to and interact with PostgreSQL databases. This package is essential for developers who rely on Java to build applications that require database access. However, a recent vulnerability has been identified that could potentially compromise the security of applications using this package.
Vulnerability Detail
The vulnerability, identified as CVE-2026-42198, is a client-side Denial of Service (DoS) issue that arises from malicious SCRAM-SHA-256 authentication attempts. An attacker could exploit this vulnerability to disrupt the normal functioning of applications that utilize the postgresql-jdbc package, leading to service interruptions and potential data access issues. This vulnerability highlights the importance of maintaining updated software to mitigate security risks.
How To Fix
Minimum fixed version
42.2.14-4.el8_10
This is the first release that contains the fix.
sudo dnf update postgresql-jdbcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement stricter validation on authentication requests to mitigate the risk of exploitation until the package is updated. This may involve configuring the application to reject suspicious authentication attempts.
Conclusion
The postgresql-jdbc package has a critical vulnerability that could lead to Denial of Service attacks. It is essential for users to update to the latest patched version to ensure the security and stability of their applications. By staying informed and proactive, developers can protect their systems from potential threats.
See every vulnerability recorded for postgresql-jdbc →
FAQ
CVE-2026-42198 is a security vulnerability in the postgresql-jdbc package that allows for client-side Denial of Service attacks through malicious SCRAM-SHA-256 authentication.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to service disruptions and potential data access issues for applications relying on the postgresql-jdbc package.
Yes, a patch is available. Users should update to version 42.2.14-4.el8_10 or later to mitigate the vulnerability.
If immediate updating is not possible, consider implementing stricter validation on authentication requests as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc.
