# CVE-2026-42198: postgresql-jdbc: pgjdbc is an open source postgresql JDBC Driver

CVE-2026-42198 is fixed in 3 products on 1 platform, first by RHSA-2026:52928, released April 29, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-42198
- Priority: High
- CVSS: 7.5 (important)
- EPSS: 0.0326
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 29, 2026

## Description

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libpgjava Debian 14 | 42.7.11-1 | [DEBIAN-CVE-2026-42198](https://patchblox.com/security/data/fix/linux/debian-cve-2026-42198.md) | May 15, 2026 |
| Linux | postgresql-jdbc RHEL 10 | 42.7.1-7.el10_0.1 | [RHSA-2026:52928](https://patchblox.com/security/data/fix/linux/rhsa-2026-52928.md) | Apr 29, 2026 |
| Linux | postgresql-jdbc RHEL 8 | 0:42.2.14-4.el8_10 | [RHSA-2026:25030](https://patchblox.com/security/data/fix/linux/rhsa-2026-25030.md) | Jun 24, 2026 |
| Linux | postgresql-jdbc RHEL 9 | 0:42.2.28-2.el9_8.2 | [RHSA-2026:22304](https://patchblox.com/security/data/fix/linux/rhsa-2026-22304.md) | Jun 24, 2026 |
| Linux | postgresql-jdbc almalinux 10 | 42.7.2-1.el10_2.2 | [ALSA-2026:24348](https://patchblox.com/security/data/fix/linux/alsa-2026-24348.md) | Jun 8, 2026 |
| Linux | postgresql-jdbc almalinux 8 | 42.2.14-4.el8_10 | [ALSA-2026:25030](https://patchblox.com/security/data/fix/linux/alsa-2026-25030.md) | Jun 10, 2026 |
| Linux | postgresql-jdbc almalinux 9 | 42.2.28-2.el9_8.2 | [ALSA-2026:22304](https://patchblox.com/security/data/fix/linux/alsa-2026-22304.md) | Jun 1, 2026 |
| Linux | postgresql-jdbc ol 10 | 0:42.7.2-1.el10_2.2 | [ELSA-2026-24348](https://patchblox.com/security/data/fix/linux/elsa-2026-24348.md) | Jul 16, 2026 |
| Linux | postgresql-jdbc ol 8 | 0:42.2.14-4.el8_10 | [ELSA-2026-25030](https://patchblox.com/security/data/fix/linux/elsa-2026-25030.md) | Jun 10, 2026 |
| Linux | postgresql-jdbc ol 9 | 0:42.2.28-2.el9_8.2 | [ELSA-2026-22304](https://patchblox.com/security/data/fix/linux/elsa-2026-22304.md) | Jun 23, 2026 |
| Linux | postgresql-jdbc rocky 10 | 0:42.7.2-1.el10_2.2 | [RLSA-2026:24348](https://patchblox.com/security/data/fix/linux/rlsa-2026-24348.md) | Jun 11, 2026 |
| Linux | postgresql-jdbc rocky 8 | 0:42.2.14-4.el8_10 | [RLSA-2026:25030](https://patchblox.com/security/data/fix/linux/rlsa-2026-25030.md) | Jun 11, 2026 |
| Linux | postgresql-jdbc rocky 9 | 0:42.2.28-2.el9_8.2 | [RLSA-2026:22304](https://patchblox.com/security/data/fix/linux/rlsa-2026-22304.md) | Jun 2, 2026 |
| Linux | postgresql-jdbc sles 16.0 | 42.7.7-160000.3.1 | [SUSE-SU-2026:22000-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22000-1.md) | May 29, 2026 |
| Linux | postgresql-jdbc-javadoc RHEL 8 | 0:42.2.14-4.el8_10 | [RHSA-2026:25030](https://patchblox.com/security/data/fix/linux/rhsa-2026-25030.md) | Jun 24, 2026 |
| Linux | postgresql-jdbc-javadoc almalinux 8 | 42.2.14-4.el8_10 | [ALSA-2026:25030](https://patchblox.com/security/data/fix/linux/alsa-2026-25030.md) | Jun 10, 2026 |
| Linux | postgresql-jdbc-javadoc ol 8 | 0:42.2.14-4.el8_10 | [ELSA-2026-25030](https://patchblox.com/security/data/fix/linux/elsa-2026-25030.md) | Jun 10, 2026 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.