Red Hat Patches pgjdbc SCRAM Authentication CPU Exhaustion Flaw
Vulnerability Disclosure · 3 sources · Updated 3mo ago · First seen Aug 26, 2026
Red Hat released Important security updates for postgresql-jdbc to remediate CVE-2026-42198, a client-side denial-of-service flaw in the PostgreSQL JDBC driver (pgjdbc). A malicious PostgreSQL server can return an excessively large SCRAM-SHA-256 iteration count during authentication, forcing clients to perform unbounded PBKDF2 calculations. One login can monopolize a CPU core, while repeated or concurrent attempts can exhaust host resources and wedge database connection pools; loginTimeout did not reliably interrupt the background calculation.
The issue affects pgjdbc versions 42.2.0 through versions before 42.7.11. Red Hat's updates cover affected RHEL 8.4 and 8.6 Advanced Update Support and Extended Life Cycle Long Life deployments on x86_64, providing postgresql-jdbc 42.2.3-7.el8_4.1 for RHEL 8.4 and 42.2.3-5.el8_6.1 for RHEL 8.6. Organizations should apply the relevant RHSA updates and upgrade non-Red Hat deployments to pgjdbc 42.7.11 or later.
