Libpgjava: pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its… (CVE-2026-107315)

The PostgreSQL JDBC Driver (pgjdbc) versions 42.7.4 through 42.7.13 have a vulnerability where values shorter than their declared length are padded with residual bytes from the driver's send buffer rather than zeros. These residual bytes contain messages previously sent on the same connection, including SQL text and parameter values from recent statements. This leakage can occur when applications use PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes, and declare a length larger than the actual data. The vulnerability allows an attacker who can cause the application to store such a value and read it back to collect sensitive data from earlier traffic on the connection. Applications that always match declared lengths to actual data are not affected. Versions 42.7.3 and earlier pad with zeros and are not vulnerable in this way.

The vulnerability can lead to unintended data leakage where sensitive information from previous SQL statements on the same connection is exposed. This includes SQL text and parameter values, potentially compromising confidentiality. The maximum data leakage per padded value can be up to 8192 bytes, or 16320 bytes if GSS encryption is used on the connection. The vulnerability does not affect data integrity or availability but poses a confidentiality risk.

No official patch or fix status is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Applications should ensure that declared lengths always match the actual data length when using the affected methods to avoid triggering the padding issue. Until a fix is available, avoid using vulnerable versions or carefully validate input lengths to prevent leakage.