CVE-2026-107313

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption gssEncMode=prefer or require, and the server stores the value without an error. The buffer is 16320 bytes...

CVE-2026-107313

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption gssEncMode=prefer or require, and the server stores the value without an error. The buffer is 16320 bytes...

EUVD-2026-94546

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption gssEncMode=prefer or require, and the server stores the value without an error. The buffer is 16320 bytes...

CVE-2026-107313 pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption gssEncMode=prefer or require, and the server stores the value without an error. The buffer is 16320 bytes...

CVE-2026-107313 pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption gssEncMode=prefer or require, and the server stores the value without an error. The buffer is 16320 bytes...

CVE-2026-107313

The PostgreSQL JDBC Driver (pgjdbc) versions 42.7.4 and 42.7.5 contain a vulnerability where the driver can send previous contents of the GSS send buffer instead of the intended large value on connections using GSS encryption (specifically when gssEncMode is set to prefer or require). This occurs...

CVE-2026-107313 pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption gssEncMode=prefer or require, and the server stores the value without an error. The buffer is 16320 bytes...

CVE-2026-107313

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption gssEncMode=prefer or require, and the server stores the value without an error. The buffer is 16320 bytes...

CVE-2026-107313: Insertion of Sensitive Information Into Sent Data

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption gssEncMode=prefer or require, and the server stores the value without an error. The buffer is 16320 bytes...

PT-2026-107717

Name of the Vulnerable Software and Affected Versions pgjdbc versions 42.7.11 through 42.7.13 Description The PostgreSQL JDBC Driver fails to enforce restrictions when the requireAuth connection property excludes all six known authentication methods e.g.,...

PT-2026-107654

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption gssEncMode=prefer or require, and the server stores the value without an error. The buffer is 16320 bytes...

PT-2026-107718

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same...

Security Bulletin: Multiple vulnerabilities in PostgreSQL affect PowerVM VIOS

Summary Vulnerabilities in PostgreSQL could allow Memory Corruption/Arbitrary Code Execution CVE-2026-14662, CVE-2026-14664, CVE-2026-14669, CVE-2026-14670, CVE-2026-14671, CVE-2026-14677, CVE-2026-14679, CVE-2026-14680, CVE-2026-15742, CVE-2026-16239, CVE-2026-19385, Information Disclosure...

Multiple vulnerabilities in PostgreSQL affect PowerVM VIOS

IBM SECURITY ADVISORY First Issued: Tue Oct 6 01:00:55 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/postgresadvisory2.asc Security Bulletin: Multiple vulnerabilities in PostgreSQL affect PowerVM VIOS...

[SECURITY] Fedora 45 Update: ocaml-postgresql-5.4.0-3.fc45

This OCaml-library provides an interface to PostgreSQL, an efficient and reliable, open source, relational database. Almost all functionality available through the C-API libpq is replicated in a type-safe way. This library uses objects for representing database connections and results of queries...

CVE-2026-20253

CVE-2026-20253 — Splunk Enterprise Pre-Auth RCE Lab Unauthenticated Arbitrary File Creation and Truncation via PostgreSQL Sidecar CVSS 9.8 · Critical · CWE-306 · Actively exploited CISA KEV ⚠️ Disclaimer This repository is intended strictly for educational and authorised security research purposes...

Astra Linux – Vulnerability in PostgresSQL 11

A man-in-the-middle attacker can inject false responses to the client’s first few queries, despite the use of SSL certificate verification and encryption...

Astra Linux – Vulnerability in Sogo

Before version 5.12.7, when PostgreSQL was used, SOGo allowed SQL injection attacks...

Astra Linux – Vulnerability in PostgresSQL 11

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using the Postgres database extension, providing invalid parameters to the parameterized query may cause PHP to attempt to free memory by using uninitialized data as pointers. This could lead to a RCE vulnerabilit...