Vulnerability in pgjdbc

[ Description ]Official description

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid.

[ Fixes ]Fixes and patches

• Security bulletin: PostgreSQLVendor patch or bulletin · CERT-FR · github.com/pgjdbc/pgjdbc/security/advisories/GHSA-f64h-wr5q-3qf3, cited by CERT-FR CERTFR-2026-AVI-1292
• Security bulletin: PostgreSQLVendor patch or bulletin · CERT-FR · github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h, cited by CERT-FR CERTFR-2026-AVI-1292
• Security bulletin: PostgreSQL 2026-10-07-postgresql-jdbc-42714-security-update-for-multiple-cves-3399Vendor patch or bulletin · CERT-FR · postgresql.org/about/news/2026-10-07-postgresql-jdbc-42714-security-up, cited by CERT-FR CERTFR-2026-AVI-1292

[ Advisories ]Government CERT advisories

• CERT-FR12 Oct 2026CERTFR-2026-AVI-1292

  Multiple vulnerabilities in PostgreSQL JDBC Translated from French

  Multiple vulnerabilities have been discovered in PostgreSQL JDBC. They allow an attacker to cause a breach of data confidentiality and a security policy bypass.

  CVE-2026-107315CVE-2026-107314
• BSI CERT-Bund7 Oct 2026WID-SEC-2026-3807

  PostgreSQL JDBC Driver: Multiple vulnerabilities Translated from German

  CVE-2026-107315CVE-2026-107314CVE-2026-107313

[ References ]References

• github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h