Denial of Service Vulnerability in PostgreSQL JDBC Driver

CVE-2026-42198

What is CVE-2026-42198?

The PostgreSQL JDBC Driver (pgjdbc) is susceptible to a denial of service attack during SCRAM-SHA-256 authentication. This vulnerability exists in pgjdbc versions from 42.2.0 to prior to 42.7.11, where a malicious server could trigger an excessive iteration count during SCRAM authentication. This leads to an unbounded CPU consumption on the client side while processing PBKDF2, which can effectively lock the CPU core. Even with a login timeout implemented, the worker thread handling the connection may still consume CPU time beyond the timeout, potentially exhausting client resources or wedging connection pools. The issue has been resolved in version 42.7.11.

References