Critical Vulnerability in postgresql-jdbc: Client-side Denial of Service via SCRAM-SHA-256 Authentication
Summary
ALSA-2026:22304: Important: postgresql-jdbc security update. Affects postgresql-jdbc versions < 42.2.28-2.el9_8.2. Fixed in 42.2.28-2.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful object-relational database management system known for its robustness and advanced features. The postgresql-jdbc package provides the necessary .jar files for Java applications to connect and interact with PostgreSQL databases. This package is essential for developers who rely on Java for database operations, making it a critical component in many applications. However, a recent vulnerability has been identified that could compromise the security of applications using this package.
Vulnerability Detail
The vulnerability, identified as CVE-2026-42198, allows for a client-side Denial of Service (DoS) attack through malicious SCRAM-SHA-256 authentication attempts. This means that an attacker could exploit this vulnerability to disrupt the normal functioning of applications that utilize the postgresql-jdbc package, potentially leading to service outages and degraded performance. The issue arises from improper handling of authentication requests, which can be manipulated to cause the application to become unresponsive.
How To Fix
Minimum fixed version
42.2.28-2.el9_8.2
This is the first release that contains the fix.
sudo dnf update postgresql-jdbcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling SCRAM-SHA-256 authentication if it is not essential for your application. This can be done by modifying the PostgreSQL configuration file to use a different authentication method until the package is updated.
Conclusion
The postgresql-jdbc package has a critical vulnerability that can lead to Denial of Service attacks through malicious authentication attempts. It is crucial for users to update to the patched version to mitigate risks. Additionally, temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for postgresql-jdbc →
FAQ
CVE-2026-42198 is a vulnerability in the postgresql-jdbc package that allows for client-side Denial of Service attacks through malicious SCRAM-SHA-256 authentication.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability could lead to service outages and degraded performance of applications that rely on the postgresql-jdbc package.
Yes, a patch is available in the form of an updated version of the postgresql-jdbc package, specifically version 42.2.28-2.el9_8.2.
If immediate updating is not possible, consider disabling SCRAM-SHA-256 authentication as a temporary workaround until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc.
