Libpgjava: pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a… (CVE-2026-107313)

The vulnerability (CVE-2026-107313) affects pgjdbc versions 42.7.4 and 42.7.5 when GSS encryption is enabled with modes 'prefer' or 'require'. The driver incorrectly sends the previous contents of the GSS send buffer (16320 bytes with MIT Kerberos) instead of the first part of a value during certain write operations involving byte arrays, such as bind parameters set with setString, setBytes, ByteStreamWriter, CopyIn.writeToCopy, and LargeObject.write. This causes the server to store unintended data from earlier messages on the same connection. Most writes of this nature fail with an ArrayIndexOutOfBoundsException, but values at least as long as the buffer are affected. Versions 42.7.3 and earlier do not exhibit this behavior, and the issue is resolved in version 42.7.6. The default GSS encryption mode 'allow' does not trigger GSS encryption and is unaffected.

The vulnerability can lead to the server storing unintended data from previous messages in place of the intended application data during certain write operations over GSS-encrypted connections. This may cause data integrity issues and potentially expose sensitive information from prior messages within the same connection. The impact is limited to connections using GSS encryption modes 'prefer' or 'require'. There is no indication of denial of service or remote code execution. The CVSS score is 4.2 (medium severity) reflecting low confidentiality and integrity impacts with no availability impact.

Upgrade pgjdbc to version 42.7.6 or later, where this issue is fixed. Connections using the default GSS encryption mode 'allow' or without GSS encryption are not affected. No other mitigation is indicated by the vendor advisory.