PT-2026-35952 · Pgjdbc · Pgjdbc

Sehrope · Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-42198

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions pgjdbc versions 42.2.0 through 42.7.10

Description A client-side denial of service occurs during SCRAM-SHA-256 authentication. A malicious server can force the driver to execute SCRAM authentication using an excessively large iteration count, causing the client to consume an unbounded amount of CPU time within the PBKDF2 (Password-Based Key Derivation Function 2) process. This can tie up a CPU core per attempt, and concurrent attempts may exhaust client CPU resources and freeze connection pools. The loginTimeout parameter does not fully mitigate this issue, as the worker thread may continue the PBKDF2 computation even after the timeout expires.

Recommendations Update to version 42.7.11.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-42198

Affected Products

Pgjdbc

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-42198 · Security Note
• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq · Note
• https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11 · Note
• https://twitter.com/KaitanSecurity/status/2049526631279034682 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049616383156048003 · Twitter Post
• https://twitter.com/CVEnew/status/2049578393990226133 · Twitter Post