CVE-2024-1597: SQL Injection in org.postgresql:postgresql
Summary
CVE-2024-1597: org.postgresql:postgresql vulnerable to SQL Injection via line comment generation. Affects org.postgresql:postgresql across 6 version ranges.
< 42.2.28
>= 42.3.0, < 42.3.9
>= 42.4.0, < 42.4.4
>= 42.5.0, < 42.5.5
>= 42.6.0, < 42.6.1
>= 42.7.0, < 42.7.2
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- postgresql-jdbc-driver · Bitnami
- libpgjava · Debian:11
The same CVE-2024-1597 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.postgresql:postgresql package is an open-source JDBC driver for PostgreSQL databases. It provides connectivity and interaction between Java applications and PostgreSQL databases. This package is widely used in various applications and frameworks that require database access. However, a vulnerability has been discovered in versions prior to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, 42.2.28, and 42.2.28.jre7, which allows for SQL injection attacks when using the non-default connection property preferQueryMode=simple in combination with vulnerable SQL code that negates a parameter value.
Vulnerability Detail
The vulnerability arises when certain conditions are met: a placeholder for a numeric value is immediately preceded by a minus sign, there is a second placeholder for a string value after the first placeholder on the same line, and both parameters are user-controlled. In the vulnerable scenario, the driver inlines the negative value of the first parameter, treating the resulting line as a SQL comment. This comment extends to the beginning of the next parameter, consuming the quoting of that parameter if it includes a newline. This can lead to the injection of user-controlled text into the resulting SQL, potentially altering the command's behavior or executing arbitrary SQL commands. The default extended query mode is not affected by this vulnerability.
How To Fix
Latest published version: 42.7.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 42.2.2842.2.28 -
>= 42.3.0, < 42.3.942.3.9 -
>= 42.4.0, < 42.4.442.4.4 -
>= 42.5.0, < 42.5.542.5.5 -
>= 42.6.0, < 42.6.142.6.1 -
>= 42.7.0, < 42.7.242.7.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the patched versions is not immediately feasible, a workaround is to avoid using the connection property preferQueryMode=simple. By not explicitly specifying the query mode, the default mode of extended is used, which is not affected by this vulnerability.
Conclusion
The org.postgresql:postgresql package is vulnerable to SQL injection attacks when using the non-default connection property preferQueryMode=simple. Upgrading to the patched versions or avoiding the use of preferQueryMode=simple mitigates this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.postgresql:postgresql →
FAQ
The vulnerability allows for SQL injection attacks, potentially leading to unauthorized access, data manipulation, or arbitrary command execution on the database server.
No, only versions prior to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, 42.2.28, and 42.2.28.jre7 are affected. Upgrading to the patched versions resolves the vulnerability.
No, the default extended query mode is not affected by this vulnerability. Only when using the non-default connection property preferQueryMode=simple does the vulnerability arise.
Yes, this vulnerability can be exploited remotely if the application using the org.postgresql:postgresql package is exposed to untrusted user input.
There are no known public exploits for this vulnerability at the time of this advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.postgresql:postgresql.
