OESA-2026-2446

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2446

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-2446.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-2446

Upstream

CVE-2026-42198

Published

2026-05-22T13:22:35Z

Modified

2026-05-22T13:30:13.114207487Z

Summary

postgresql-jdbc security update

Details

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.

Security Fix(es):

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.(CVE-2026-42198)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:22.03-LTS-SP4 / postgresql-jdbc

Package

Name: postgresql-jdbc
Purl: pkg:rpm/openEuler/postgresql-jdbc&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

42.4.1-4.oe2203sp4

Ecosystem specific

{
    "noarch": [
        "postgresql-jdbc-42.4.1-4.oe2203sp4.noarch.rpm",
        "postgresql-jdbc-help-42.4.1-4.oe2203sp4.noarch.rpm",
        "postgresql-jdbc-javadoc-42.4.1-4.oe2203sp4.noarch.rpm"
    ],
    "src": [
        "postgresql-jdbc-42.4.1-4.oe2203sp4.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-2446.json"