jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication

🗓️ 20 May 2026 12:47:06Reported by RedHatType

Pgjdbc flaw lets a malicious server trigger excessive SCRAM-SHA-256 iterations, causing client DoS.

Reporter	Title	Published	Views	Family All 111
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact 7.1.1.0	1 Jul 202619:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in the Containerized Version of IBM Guardium Key Lifecycle Manager	24 Jul 202614:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	29 Jun 202603:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in postgresql-42.6.1.jar	17 Jun 202615:24	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of postgresql-42.7.10.jar, IBM Sterling Connect:Direct Web Services is affected by client-side denial of service.	4 Jun 202603:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	20 May 202620:13	–	ibm
ATTACKERKB	CVE-2026-42198	29 Apr 202615:58	–	attackerkb
Tenable Nessus	Alibaba Cloud Linux 3 : 0155: postgresql-jdbc (ALINUX3-SA-2026:0155)	16 Jun 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : postgresql-jdbc (ALSA-2026:22304)	2 Jul 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : postgresql-jdbc (ALSA-2026:25030)	11 Jun 202600:00	–	nessus

Vulners

Node

AND

redhat quarkusRange<3.27el8

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-42198
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11
github	www.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42198
cve	www.cve.org/CVERecord

10 Jul 2026 01:19Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.5

EPSS0.0077

SSVC