CVE-2026-107313
- Source
- https://cve.org/CVERecord?id=CVE-2026-107313
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107313.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-107313
- Aliases
-
- GHSA-hggc-j2qh-988m
- Downstream
- Published
- 2026-10-07T18:19:53Z
- Modified
- 2026-10-28T10:51:08Z
- Severity
-
- 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections
- Details
-
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos. The stored value then holds bytes of the messages the driver sent just before it on the same connection, such as the statement's SQL text, its other parameters, and earlier rows of the same batch, instead of the bytes the application supplied. Values at least as long as the buffer are affected when the driver writes them from a byte array: bind parameters set with setString, setBytes, or a ByteStreamWriter, CopyIn.writeToCopy, and LargeObject.write. Most such writes fail with an ArrayIndexOutOfBoundsException instead. The default, gssEncMode=allow, does not start GSS encryption, and connections without GSS encryption are not affected. Versions 42.7.3 and earlier are not affected, and 42.7.6 fixes the problem.
- Database specific
{ "cna_assigner": "PostgreSQL", "cwe_ids": [ "CWE-201" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107313.json" }- References
-
- https://repo.maven.apache.org/maven2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107313.json
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hggc-j2qh-988m
- https://nvd.nist.gov/vuln/detail/CVE-2026-107313
- https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb
- https://github.com/pgjdbc/pgjdbc/pull/3500
- https://github.com/pgjdbc/pgjdbc
Affected packages
Git / github.com/pgjdbc/pgjdbc
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pgjdbc/pgjdbc
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "42.7.4" }, { "fixed": "42.7.6" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "96f6862bb6bcadde7620688c7bce73f2d01a7ebb" } ], "source": "REFERENCES_COMMIT" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107313.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"255557241867914542106016165782751941011",
"309503449476030119478785674594959288746",
"17378005348805920162978153016396974471",
"39502963300054169968996243807465350312"
],
"threshold": 0.9
},
"id": "CVE-2026-107313-050eb48f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/test/java/org/postgresql/jdbc/LargeObjectManagerTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "39228195594869501612037286000509698766",
"length": 981
},
"id": "CVE-2026-107313-21aa3d75",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/gss/GSSInputStream.java",
"function": "read"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"12577298303470672748566023888888250339",
"168094664813028152519119979718357785920",
"269304714559449688132262098121428934793",
"180589878036165230489948239859981373562",
"271168418990247470388287899369234051807",
"194695408166834469776599814482448342272",
"101571892718927315496683891877751344993",
"136722441687544641164681937967598875526",
"166667675628098796177229311814930177909",
"179337196517886574215941019204737229877",
"23955935026857136021517131367835796923",
"69934644512487401199104068180968725657",
"252832644557540618241024419488278589721",
"260651494146100419416100034128236310020",
"92869879633623261670716684346038456442",
"215004396002136346989721806078898036465"
],
"threshold": 0.9
},
"id": "CVE-2026-107313-27e56c75",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/testFixtures/java/org/postgresql/test/util/StrangeInputStream.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"245584530558840297706676149375269581841",
"61919195314541633737362566166372981609",
"139924308945485134787998610017368558407",
"184697927301212065372351583959478830178",
"86311504944371929244065466908278202078",
"101824231606913300145700818015793306960",
"251831536191803304812745127341964586400",
"170980366194015480385398729557617787112",
"266501533473161679812324101658733469020",
"157735882545120145124949006871529390495",
"216062776701399584785066417447272146293",
"122223340606591240828325841452685486469",
"193596584164281480770682983579468471363",
"95810945920847832666697889690438541661",
"83718806507214199645198942490337536680",
"291832511610312747842242474803226182307",
"100746589232831376974311227504298606395",
"36454370195595579710352705717293782726",
"180718334924002272958408912939994138481",
"10103982219223589411756513260809593102",
"16789782055368030388725240257882213943",
"78000329312292052329378543934940493777",
"335161003666245246595955604978435930391",
"326533000958074849428728141976754098168",
"187066419452561891433935273515769695370",
"260090419555441274248328343431477308731",
"144731786444455499071573816004861157633",
"93846010548707774559768668616213573388",
"141580723505297994507271405913652776032",
"319813371772698738046361402512462813305",
"58897575853479959730285505967804528906",
"97543214818947612137983286767982869398",
"77548278941908242897695075334308567608",
"109305647009994403698050395202176400671",
"253387184547983403252448372825286647932",
"62495212172623389184434581116399477338",
"191464519724311383375693606978982853821",
"35677920559968956308796327009433987227",
"20435110114580899530447057285634371047",
"21141506739590097519569095233218983098",
"35331562261990261613496690079495943764",
"332424130201559288702859076265125643500",
"45266027717963965509857080835648586259",
"35331562261990261613496690079495943764"
],
"threshold": 0.9
},
"id": "CVE-2026-107313-3ff65c6a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/gss/GSSInputStream.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "125578231658165053398871628433774631519",
"length": 52
},
"id": "CVE-2026-107313-55ffb527",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/gss/GSSInputStream.java",
"function": "read"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "80452311101451691462076153488773259088",
"length": 300
},
"id": "CVE-2026-107313-5f4dffcf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/gss/GSSOutputStream.java",
"function": "writeWrapped"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"312011502255647237805622133127235873185",
"180714258621711081213482251749774183425",
"299698759448384630639509023249570955701",
"103159568972041071576648888985984798825",
"23663072606848110313815397813323538384"
],
"threshold": 0.9
},
"id": "CVE-2026-107313-8779d09c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "benchmarks/src/jmh/java/org/postgresql/benchmark/largeobject/LargeObjectRead.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "221619402431447718887401242934483235861",
"length": 148
},
"id": "CVE-2026-107313-ab1528e3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/testFixtures/java/org/postgresql/test/util/StrangeInputStream.java",
"function": "read"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "121925793801014976385517717172247655376",
"length": 151
},
"id": "CVE-2026-107313-b8235623",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "benchmarks/src/jmh/java/org/postgresql/benchmark/largeobject/LargeObjectRead.java",
"function": "readArrayRandom"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"325799512888451899990411019286775196063",
"291131495122256860581907469222797020382",
"52510544653910780499561119454358865215",
"161234420238402276085406198793751030817"
],
"threshold": 0.9
},
"id": "CVE-2026-107313-bbb7ed69",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/test/java/org/postgresql/test/jdbc2/CopyLargeFileTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"246449096222623596448040077394358788286",
"308212815518936294289376067390853865976",
"56409361179386547837029624884507686782",
"86503108891333321503696352755576611094"
],
"threshold": 0.9
},
"id": "CVE-2026-107313-c056be38",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/gss/GSSOutputStream.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "143813972401273996057753227150879367835",
"length": 337
},
"id": "CVE-2026-107313-c3ceb8a2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/testFixtures/java/org/postgresql/test/util/StrangeInputStream.java",
"function": "read"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "25313611805616855346549460736366005028",
"length": 1659
},
"id": "CVE-2026-107313-f4b4d3a7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/test/java/org/postgresql/jdbc/LargeObjectManagerTest.java",
"function": "objectWriteThenRead"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "311614401236126021351155162605397774640",
"length": 764
},
"id": "CVE-2026-107313-fee52e60",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb",
"target": {
"file": "pgjdbc/src/test/java/org/postgresql/test/jdbc2/CopyLargeFileTest.java",
"function": "feedTableAndCheckTableFeedIsOk"
}
}
]
vanir_signatures_modified
"2026-10-28T10:51:08Z"