Insertion of Sensitive Information Into Sent Data in Postgresql JDBC Driver - CVE-2026-107315
Published: November 6, 2026
Vulnerability identifier: #VU159846
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-107315
CWE-ID: CWE-201
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to disclose SQL text and parameter values from earlier statements on the same database connection.
The vulnerability exists due to incomplete clearing of reused output buffers in the PostgreSQL JDBC Driver when an application supplies less data than its declared length. A low-privileged remote attacker can make the application store such values and read them back repeatedly to collect earlier traffic, including data from other requests on pooled connections.
Affected software
Postgresql JDBC Driver
How to mitigate CVE-2026-107315
Install security update from vendor's website.
Postgresql JDBC Driver - update to 42.7.14