SB2026063034 - Algorithm Downgrade in Postgresql JDBC Driver

Description

This security bulletin contains information about 1 vulnerability.

1) Algorithm Downgrade (CVE-ID: CVE-2026-54291)

CWE-ID: CWE-757 - Selection of Less-Secure Algorithm During Negotiat

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass channel-binding protection and enable a man-in-the-middle downgrade of authentication.

The vulnerability exists due to failing open and algorithm downgrade in ScramAuthenticator when processing certificates whose signature algorithm has no tls-server-end-point channel-binding hash. A remote attacker can present a certificate with an unsupported signature algorithm while intercepting the TLS connection to bypass channel-binding protection and enable a man-in-the-middle downgrade of authentication.

Only connections configured with channelBinding=require are affected.

Remediation

Install update from vendor's website.

References

• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867
• https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99