Loading vulnerability…
pgjdbc SCRAM-SHA-256 PBKDF2 CPU Exhaustion
CVE-2026-42198 is a client-side denial-of-service vulnerability in the PostgreSQL JDBC driver, pgjdbc, affecting versions 42.2.0 through versions before 42.7.11. During SCRAM-SHA-256 authentication, a malicious server can supply an excessively large iteration count, causing prolonged PBKDF2 computation without an effective computational bound. A single connection attempt can occupy a client CPU core, while repeated or concurrent attempts can exhaust CPU resources and render connection pools unresponsive. In affected versions, connection worker threads may continue computing after loginTimeout expires and the caller stops waiting.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation degrades or disrupts applications using the vulnerable driver by consuming client CPU resources during database authentication. One attempt can occupy a CPU core; repeated or concurrent attempts can exhaust available CPU and leave connection pools unresponsive. The vulnerability affects availability, with no identified confidentiality or integrity impact.
If you can’t patch tonight, do this now.
Do not rely on loginTimeout alone: authentication worker threads can continue consuming CPU after the timeout expires. As defense in depth until patching is complete, restrict database connections to trusted server endpoints and prevent untrusted parties from controlling connection destinations. No verified complete interim workaround is identified.
Patch, then assume compromise.
Upgrade pgjdbc, distributed as org.postgresql:postgresql, to version 42.7.11 or later. For vendor-packaged or embedded deployments, apply the applicable vendor security update that includes the corrected driver or a backported fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.