Insertion of Sensitive Information Into Sent Data in Postgresql JDBC Driver - CVE-2026-107313
Published: November 6, 2026
Vulnerability identifier: #VU159844
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-107313
CWE-ID: CWE-201
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to corrupt stored values with earlier messages from the same connection.
The vulnerability exists due to stale send-buffer reuse in the PostgreSQL JDBC Driver during large writes over GSS-encrypted connections using gssEncMode=prefer or gssEncMode=require. A remote authenticated attacker can submit values of at least 16320 bytes with suitable buffer alignment, causing earlier SQL text or parameter data to replace supplied bytes without an error.
Affected software
Postgresql JDBC Driver
How to mitigate CVE-2026-107313
Install security update from vendor's website.
Postgresql JDBC Driver - update to 42.7.6