Loading story…
Red Hat released Important security updates for postgresql-jdbc to remediate CVE-2026-42198, a client-side denial-of-service flaw in the PostgreSQL JDBC driver (pgjdbc). A malicious PostgreSQL server can return an excessively large SCRAM-SHA-256 iteration count during authentication, forcing clients to perform unbounded PBKDF2 calculations. One login can monopolize a CPU core, while repeated or concurrent attempts can exhaust host resources and wedge database connection pools; loginTimeout did not reliably interrupt the background calculation.
The issue affects pgjdbc versions 42.2.0 through versions before 42.7.11. Red Hat's updates cover affected RHEL 8.4 and 8.6 Advanced Update Support and Extended Life Cycle Long Life deployments on x86_64, providing postgresql-jdbc 42.2.3-7.el8_4.1 for RHEL 8.4 and 42.2.3-5.el8_6.1 for RHEL 8.6. Organizations should apply the relevant RHSA updates and upgrade non-Red Hat deployments to pgjdbc 42.7.11 or later.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisories RHSA-2026:59277 and RHSA-2026:59278 to remediate CVE-2026-42198 for RHEL 8.6 and RHEL 8.4 AUS and Extended Life Cycle Long Life channels, respectively. The updates include postgresql-jdbc 42.2.3-5.el8_6.1 for 8.6 and 42.2.3-7.el8_4.1 for 8.4.
pgjdbc fixed CVE-2026-42198 in version 42.7.11. The flaw allowed a malicious PostgreSQL server to provide an excessively large SCRAM-SHA-256 iteration count, causing unbounded client CPU consumption during PBKDF2 processing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat, Oracle Linux, and AlmaLinux released PostgreSQL security updates addressing broad sets of vulnerabilities, including **CVE-2026-18408**, a restore-time arbitrary-code-execution flaw in malicious `pg_dump` output, and **CVE-2026-14662**, where crafted `tsvector` or `tsquery` inputs can trigger an out-of-bounds write and potentially execute code as the PostgreSQL operating-system account. CVE-2026-18408 can cause code execution under the client account restoring a dump through `psql` meta-command expansion; `pg_dumpall` and some `pg_restore` workflows are also affected. PostgreSQL fixed these flaws in 18.5, 17.11, 16.15, 15.19, and 14.24. The updates also address **CVE-2026-6476**, which permits users with `pg_create_subscription` rights to arrange superuser SQL execution when `pg_createsubscriber` runs, and **CVE-2026-6638**, a logical-replication SQL injection triggered by a crafted replicated table name during `ALTER SUBSCRIPTION ... REFRESH PUBLICATION`. Red Hat’s Important RHEL 10 advisory `RHSA-2026:67280` updates `postgresql18` to 18.6 and covers 19 CVEs; Oracle Linux 9 and AlmaLinux 10 advisories similarly cover PostgreSQL 16/18 packages and report exploits as available. Organizations should promptly apply vendor updates, prioritize internet-exposed databases, restrict untrusted dump restoration and subscription-management privileges, and review affected extensions and client tooling.
Sep 17, 2026
Red Hat released kernel and live-patch updates for supported Red Hat Enterprise Linux (RHEL) 6, 7, and 8 lifecycle channels to remediate **CVE-2021-0920** and **CVE-2021-4083**. CVE-2021-0920 is a use-after-free flaw in the UNIX-domain socket garbage collector, `unix_gc()`, that can enable local privilege escalation; CVE-2021-4083 is a related file-descriptor lifetime race in `fget()` that can leave garbage-collected socket objects reachable and trigger a read-after-free condition. The fixes were distributed through standard kernel packages and `kpatch-patch` live-kernel modules for affected Extended Update Support, SAP, telecommunications, virtualization, and Real Time offerings. Several advisories also bundled fixes for other privilege-escalation, use-after-free, information-disclosure, and denial-of-service flaws, including CVE-2021-4028, CVE-2022-0330, CVE-2022-0492, and CVE-2022-22942. Administrators should apply the applicable kernel update and reboot systems where required; deployments using the supplied live-patch modules can receive covered fixes without a conventional reboot.
Aug 27, 2026
Red Hat released Moderate-severity advisory **RHSA-2024:9500** for Red Hat Enterprise Linux 8.6, updating the kernel to `4.18.0-372.129.1.el8_6`. The update remediates three use-after-free flaws: **CVE-2022-48695** in the `mpt3sas` SCSI driver, **CVE-2024-26656** in the AMDGPU DRM driver, and **CVE-2024-46858** in MPTCP path-manager timer handling. CVE-2022-48695 arises from incorrect `refcount_t` handling during `mpt3sas` controller resets and can allow a low-privileged local attacker to cause a denial of service without user interaction. Affected RHEL 8.6 Extended Life Cycle Long Life, AUS, TUS, and SAP Solutions offerings should install the applicable kernel package and reboot to activate the fixes; Red Hat rates the issue 5.5 CVSS v3.1 based on availability impact, while NVD and cve.org assign 7.8 scores.
Aug 26, 2026