Data Leakage Vulnerability in PostgreSQL JDBC Driver Affects Security Practices

CVE-2026-107315

What is CVE-2026-107315?

The PostgreSQL JDBC Driver versions 42.7.4 through 42.7.13 contain a vulnerability where padding occurs with leftover bytes from previous messages instead of zeros. This flaw can expose sensitive SQL text and parameter values from previously executed statements across pooled connections. When an application mistakenly declares a larger length for data during storage operations via methods like PreparedStatement.setObject and others, an attacker could exploit this to read earlier traffic, compromising data integrity and confidentiality. Applications ensuring that declared lengths match their data inputs are not prone to this issue, enhancing their security against potential exploitation.

References