Critical Security Update for PostgreSQL JDBC: Client-side Denial of Service Vulnerability
Summary
ALSA-2026:24348: Important: postgresql-jdbc security update. Affects postgresql-jdbc versions < 42.7.2-1.el10_2.2. Fixed in 42.7.2-1.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful object-relational database management system known for its robustness and advanced features. The postgresql-jdbc package provides the necessary .jar files for Java applications to connect and interact with PostgreSQL databases. This package is essential for developers who rely on Java to communicate with PostgreSQL, making it a critical component in many enterprise applications.
Vulnerability Detail
The vulnerability identified as CVE-2026-42198 allows for a client-side Denial of Service (DoS) attack through malicious SCRAM-SHA-256 authentication. This means that an attacker could exploit this flaw to disrupt the normal operation of applications that rely on the postgresql-jdbc package, potentially leading to service outages and impacting business operations. The vulnerability arises from improper handling of authentication requests, which can be manipulated to cause the client to become unresponsive.
How To Fix
Minimum fixed version
42.7.2-1.el10_2.2
This is the first release that contains the fix.
sudo dnf update postgresql-jdbcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate patching is not possible, consider disabling SCRAM-SHA-256 authentication in your application configuration until the package can be updated. This may involve modifying your database connection settings to use a different authentication method.
Conclusion
The postgresql-jdbc package has a critical vulnerability that could allow for client-side Denial of Service attacks. It is essential to update to the patched version to mitigate risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for postgresql-jdbc →
FAQ
CVE-2026-42198 is a security vulnerability in the postgresql-jdbc package that allows for a client-side Denial of Service attack through malicious SCRAM-SHA-256 authentication.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Failing to address this vulnerability could lead to service disruptions, unresponsive applications, and potential data loss, impacting your business operations.
Yes, a patch is available in the form of an updated postgresql-jdbc package version 42.7.2-1.el10_2.2.
If an immediate update is not feasible, consider disabling SCRAM-SHA-256 authentication as a temporary workaround until the package can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc.
