7.5

CVE-2026-42198: pgjdbc

CVSS: 7.5v3.1HighModified
AliasesSUSE-SU-2026:22000-1RHSA-2026:22304RHSA-2026:24348
Published 29-04-2026Last modified 11-09-2026
Open JSON

Vulnerability summary

CVE-2026-42198 is a high (CVSS 7.5) vulnerability in pgjdbc. EPSS estimates a 3.26% chance of exploitation in the next 30 days, higher than 88.2% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
3.26%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
SUSE-SU-2026:2774-1CGA-C22X-XXMG-CXMJ

Timeline

  1. 29-04-2026
    PublishedVulnerability first disclosed.
  2. 11-09-2026
    Last modifiedVulnerability information updated.

Description

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

3.26%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.26% on 20-09-2026

20-09-202620-10-2026
EPSS score
3.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard61 products
  • apache-hop< 2.17.0-r12
  • apache-hop-fips< 2.17.0-r12
  • apicurio-registry< 3.2.1-r4
  • camunda-8.8< 8.8.24-r0 | < 8.8.22-r3
  • camunda-8.9< 8.9.5-r0
Wolfi20 products
  • apicurio-registry< 3.2.1-r4
  • debezium-3.4< 3.4.3-r8
  • debezium-3.4-connect-compat< 3.4.3-r8
  • debezium-3.4-connector-jdbc< 3.4.3-r4
  • debezium-3.4-connector-postgres< 3.4.3-r4
Redhat2 products
  • postgresql-jdbc< 0:42.2.28-2.el9_8.2 | < 0:42.7.2-1.el10_2.2 | < 0:42.2.14-4.el8_10 | < 0:42.7.1-7.el10_0.1 | < 0:42.2.28-1.el9_4.1 | < 0:42.2.28-1.el9_6.1 | < 0:42.2.14-5.el8_8.1 | < 0:42.2.28-1.el9_2.1 | < 0:42.2.3-5.el8_6.1 | < 0:42.2.3-7.el8_4.1
  • postgresql-jdbc-javadoc< 0:42.2.14-4.el8_10 | < 0:42.2.14-5.el8_8.1 | < 0:42.2.3-5.el8_6.1 | < 0:42.2.3-7.el8_4.1
Suse2 products
  • postgresql-jdbc&distro=SUSE Linux Enterprise Server 16.0< 42.7.7-160000.3.1
  • postgresql-jdbc&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 42.7.7-160000.3.1
Debian1 product
  • libpgjavaAll versions (No fix recorded) | < 42.7.11-1
Opensuse1 product
  • postgresql-jdbc&distro=openSUSE Tumbleweed< 42.7.11-1.1
Org.postgresql1 product
  • postgresql≥ 42.2.0, < 42.7.11
Pgjdbc1 product
Postgresql1 product
Ubuntu1 product
  • libpgjavaAll versions (No fix recorded)

10 vendors · 91 products

References

39 links
Show all 39 references