The postgresql-jdbc package, which provides Java programs with access to PostgreSQL databases, contains a vulnerability (CVE-2026-42198) that allows a client-side denial of service via malicious SCRAM-SHA-256 authentication attempts. This vulnerability is due to improper handling of authentication requests, potentially causing resource exhaustion or application disruption on the client side. Red Hat has issued a security advisory (RHSA-2026:22304) and released updated packages for Red Hat Enterprise Linux 9 across multiple architectures to remediate this issue.

Successful exploitation of this vulnerability can cause denial of service on client applications using the postgresql-jdbc driver by sending malicious SCRAM-SHA-256 authentication data. This may disrupt database connectivity or cause application crashes on the client side. There are no reports of exploitation in the wild. The impact is limited to client-side denial of service and does not indicate remote code execution or data compromise.

Red Hat has released updated postgresql-jdbc packages for Red Hat Enterprise Linux 9 to address this vulnerability. Users should apply the security update as described in the Red Hat advisory RHSA-2026:22304 and the referenced article https://access.redhat.com/articles/11258. Applying the official update fully mitigates the vulnerability. No additional mitigation steps are required beyond installing the provided patches.