pgjdbc vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20241
3. 20251
4. 20265

Newest CVEs

• CVE-2026-107315

  pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)

  pgjdbc · pgjdbc

  Medium5.3
• CVE-2026-107314

  pgjdbc does not enforce requireAuth when the value excludes every authentication method

  pgjdbc · pgjdbc

  Medium5.9
• CVE-2026-107313

  pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections

  pgjdbc · pgjdbc

  Medium4.2
• CVE-2026-54291

  Silent channel-binding authentication downgrade via unsupported certificate algorithms

  pgjdbc · pgjdbc

  High8.2
• CVE-2026-42198

  pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

  pgjdbc · pgjdbc

  High7.5
• CVE-2025-49146

  pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

  pgjdbc · pgjdbc

  High8.2
• CVE-2024-1597

  pgjdbc SQL Injection via line comment generation

  pgjdbc · pgjdbc

  Critical10.0
• CVE-2022-41946

  TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc

  pgjdbc · pgjdbc

  Medium4.7
• CVE-2022-31197

  SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

  pgjdbc · pgjdbc

  High7.1