Red Hat Security Advisory: postgresql-jdbc security update
PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
CVE-2026-42198 is a client-side denial of service vulnerability in the PostgreSQL JDBC driver (pgjdbc) caused by malicious SCRAM-SHA-256 authentication attempts. This vulnerability affects the Red Hat build of Quarkus 3.27.3.SP2 and the postgresql-jdbc package distributed with Red Hat Enterprise Linux 10. The issue is tracked under CWE-770. Red Hat has issued security advisories RHSA-2026:19098 and RHSA-2026:24348 providing updates that fix this vulnerability. The updates include postgresql-jdbc version 42.7.2-1.el10_2.2 and the corresponding Quarkus build update. No CVSS score is provided in the advisories.
Potential Impact
An attacker can exploit this vulnerability to cause a denial of service on the client side during SCRAM-SHA-256 authentication with the PostgreSQL JDBC driver. This may disrupt Java applications using the affected JDBC driver to connect to PostgreSQL databases. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated packages for the Red Hat build of Quarkus 3.27.3.SP2 and postgresql-jdbc for Red Hat Enterprise Linux 10 that address this vulnerability. Users should apply these security updates as soon as possible. Before applying the update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258 for detailed guidance.
Red Hat Security Advisory: postgresql-jdbc security update
Description
PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-42198 is a client-side denial of service vulnerability in the PostgreSQL JDBC driver (pgjdbc) caused by malicious SCRAM-SHA-256 authentication attempts. This vulnerability affects the Red Hat build of Quarkus 3.27.3.SP2 and the postgresql-jdbc package distributed with Red Hat Enterprise Linux 10. The issue is tracked under CWE-770. Red Hat has issued security advisories RHSA-2026:19098 and RHSA-2026:24348 providing updates that fix this vulnerability. The updates include postgresql-jdbc version 42.7.2-1.el10_2.2 and the corresponding Quarkus build update. No CVSS score is provided in the advisories.
Potential Impact
An attacker can exploit this vulnerability to cause a denial of service on the client side during SCRAM-SHA-256 authentication with the PostgreSQL JDBC driver. This may disrupt Java applications using the affected JDBC driver to connect to PostgreSQL databases. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated packages for the Red Hat build of Quarkus 3.27.3.SP2 and postgresql-jdbc for Red Hat Enterprise Linux 10 that address this vulnerability. Users should apply these security updates as soon as possible. Before applying the update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258 for detailed guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:22304
- Cve Count
- 1
Threat ID: 6a1df668e29bf47b50460cf1
Added to database: 06/01/2026, 21:15:20 UTC
Last enriched: 08/13/2026, 19:46:34 UTC
Last updated: 09/13/2026, 22:01:34 UTC
Views: 188
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.