CVE-2025-49146: PostgreSQL JDBC Driver Allows Insecure Authentication Despite Channel Binding Requirement
Summary
CVE-2025-49146: pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration. Affects org.postgresql:postgresql versions >= 42.7.4, < 42.7.7. Fixed in 42.7.7. How to fix ↓
Also tracked for
- postgresql-jdbc-driver · Bitnami
- libpgjava · Debian:13
The same CVE-2025-49146 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PostgreSQL JDBC driver is a widely used library that enables Java applications to interact with PostgreSQL databases. It supports various authentication methods and is designed to ensure secure connections. However, a specific vulnerability allows the driver to fall back to insecure authentication methods, compromising the intended security features.
Vulnerability Detail
The vulnerability arises when the PostgreSQL JDBC driver is configured with channel binding set to 'required'. Despite this configuration, the driver incorrectly permits connections using authentication methods that do not support channel binding, such as password, MD5, GSS, or SSPI authentication. This flaw can be exploited by a man-in-the-middle attacker, who could intercept connections that users believe are secure, leading to potential data breaches and unauthorized access.
How To Fix
Latest published version: 42.7.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
42.7.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, configure the JDBC connection with 'sslMode=verify-full' to help prevent man-in-the-middle attacks. This can be done by adding the following parameter to your connection string:
jdbc:postgresql://host:port/database?sslMode=verify-full
Conclusion
The PostgreSQL JDBC driver vulnerability (CVE-2025-49146) poses a significant risk by allowing insecure authentication methods despite channel binding requirements. It is crucial to update to the patched version (42.7.7) or implement the recommended workaround to mitigate potential attacks.
See every vulnerability recorded for org.postgresql:postgresql →
FAQ
Channel binding is a security feature that ensures the integrity of the communication channel between the client and server, preventing man-in-the-middle attacks.
If your application uses the affected version of the PostgreSQL JDBC driver with channel binding set to 'required', it may allow insecure authentication methods, exposing your application to potential attacks.
If an immediate update is not possible, implement the workaround by setting 'sslMode=verify-full' in your connection string to enhance security temporarily.
You can use tools like Vulert, which monitors your project's pom.xml file for vulnerabilities in real-time, alerting you to any issues without requiring code access.
The CVSS score for this vulnerability is 8.2, indicating a high severity level that requires prompt attention.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.postgresql:postgresql.
