SB20261106109 - Multiple vulnerabilities in Postgresql JDBC Driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261106109

SB20261106109 - Multiple vulnerabilities in Postgresql JDBC Driver

Published: November 6, 2026

Security Bulletin ID SB20261106109
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-107313)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated attacker to corrupt stored values with earlier messages from the same connection.

The vulnerability exists due to stale send-buffer reuse in the PostgreSQL JDBC Driver during large writes over GSS-encrypted connections using gssEncMode=prefer or gssEncMode=require. A remote authenticated attacker can submit values of at least 16320 bytes with suitable buffer alignment, causing earlier SQL text or parameter data to replace supplied bytes without an error.


Remediation

Install update from vendor's website.

References