SB20261106110 - Multiple vulnerabilities in Postgresql JDBC Driver

Description

This security bulletin contains information about 2 vulnerabilities.

1) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-107314)

CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to obtain an application's database password.

The vulnerability exists due to the PostgreSQL JDBC Driver treating an empty set of permitted authentication methods as unrestricted when the non-default requireAuth configuration excludes every supported method or names none. An unauthenticated remote attacker can request cleartext password authentication while positioned between the application and its database server, causing the driver to transmit the database password.

2) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-107315)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a low-privileged remote attacker to disclose SQL text and parameter values from earlier statements on the same database connection.

The vulnerability exists due to incomplete clearing of reused output buffers in the PostgreSQL JDBC Driver when an application supplies less data than its declared length. A low-privileged remote attacker can make the application store such values and read them back repeatedly to collect earlier traffic, including data from other requests on pooled connections.

Remediation

Install update from vendor's website.

References

• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h
• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-f64h-wr5q-3qf3