CVE-2022-31197: PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow()
Summary
CVE-2022-31197: PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names. Affects org.postgresql:postgresql across 3 version ranges.
< 42.2.26
>= 42.3.0, < 42.3.7
>= 42.4.0, < 42.4.1
Fixed in 42.2.26, 42.3.7 or 42.4.1, depending on the release line you run. How to fix ↓
Also tracked for
- postgresql-jdbc-driver · Bitnami
- libpgjava · Debian:11
The same CVE-2022-31197 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PostgreSQL JDBC Driver is a Java library that allows Java applications to connect to and interact with PostgreSQL databases. It provides a set of classes and methods for executing SQL queries, managing database connections, and retrieving query results. The driver is widely used in Java applications that utilize PostgreSQL as their backend database. However, a vulnerability has been discovered in the driver's implementation of the ResultSet.refreshRow() method, which can lead to SQL injection attacks.
Vulnerability Detail
The vulnerability arises from the lack of proper escaping of column names in the ResultSet.refreshRow() method. If a malicious column name containing a statement terminator, such as a semicolon, is provided, it can result in SQL injection. This allows an attacker to execute additional SQL commands as the application's JDBC user. The impact of this vulnerability depends on whether the application invokes the ResultSet.refreshRow() method and if the underlying database is under the control of an attacker. If the conditions are met, the attacker can execute arbitrary SQL commands, potentially compromising the integrity and confidentiality of the database. The vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Latest published version: 42.7.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 42.2.2642.2.26 -
>= 42.3.0, < 42.3.742.3.7 -
>= 42.4.0, < 42.4.142.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version of the PostgreSQL JDBC Driver is not immediately feasible, users can implement the following workaround:
- Check if the application code invokes the
ResultSet.refreshRow()method. - If the method is used, ensure that the application only connects to a database that is not controlled by an unauthenticated or malicious user.
- If the application connects to its own database with a fixed schema and no DDL permissions, it will not be affected by this vulnerability as it requires a maliciously crafted schema.
Conclusion
The PostgreSQL JDBC Driver is vulnerable to SQL injection attacks when using the ResultSet.refreshRow() method. To mitigate this vulnerability, users should upgrade to versions 42.2.26, 42.3.7, or 42.4.1 of the driver. Alternatively, users can ensure that the method is not used or that the application only connects to a trusted database. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.postgresql:postgresql →
FAQ
The vulnerability affects versions prior to 42.2.26, 42.3.7, and 42.4.1 of the PostgreSQL JDBC Driver.
The vulnerability allows an attacker to execute arbitrary SQL commands as the application's JDBC user, potentially compromising the integrity and confidentiality of the database.
No, only applications that invoke the ResultSet.refreshRow() method and connect to a database that may be under the control of an attacker are vulnerable.
No, the vulnerability requires the attacker to trick the user into executing SQL against a table with malicious column names.
There are no known public exploits of this vulnerability at the time of this advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.postgresql:postgresql.
