CVE-2026-42198

Name of the Vulnerable Software and Affected Versions pgjdbc versions 42.2.0 through 42.7.10

Description A client-side denial of service occurs during SCRAM-SHA-256 (Salted Challenge Response Authentication Mechanism Secure Hash Algorithm 256) authentication. A malicious server can instruct the driver to perform authentication using an excessively large iteration count, forcing the client to spend an unbounded amount of CPU time performing PBKDF2 (Password-Based Key Derivation Function 2) computations. This can exhaust client CPU resources and wedge connection pools. In affected versions, the loginTimeout variable does not fully mitigate this issue because the worker thread continues the computation even after the caller stops waiting. This is particularly risky when applications accept connection details from untrusted sources or connect through untrusted proxies.

Recommendations Update pgjdbc to version 42.7.11 or later. Connect only to trusted PostgreSQL servers and verify server identity using TLS with sslmode=verify-full and a trusted CA. Avoid using SCRAM authentication on untrusted or interceptable connection paths. Limit parallel connection attempts and apply CPU or container limits to reduce the operational impact. Restrict the use of the loginTimeout variable as a primary mitigation measure on unpatched versions.