Pgjdbc

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 5.3MediumOct 8, 2026pgjdbc Information disclosureCVE-2026-107315pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same connection: SQL text and parameter values of recent statements, which on a pooled connection can come from other requests. Each padded value can carry up to 8192 bytes of this traffic, or 16320 bytes on a conne
• 5.9MediumOct 7, 2026pgjdbcCVE-2026-107314pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the app
• 4.2MediumOct 7, 2026pgjdbc Information disclosureCVE-2026-107313pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos. The stored value then holds bytes of the messages the driver sent just before it on the same connection, such as the statement's SQL text, its other parameters, and earlier rows of t
• 8.2HighJun 11, 2025pgjdbc Auth bypass / access controlCVE-2025-49146pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requiremen
• 10.0CriticalFeb 19, 2024pgjdbc SQL injectionCVE-2024-1597pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string v4.8% likely
• 7.1HighAug 3, 2022pgjdbc SQL injectionCVE-2022-31197PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that cont2.4% likely

See every Pgjdbc entry on the dashboard.

Top products

• pgjdbc3 CVEs in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• Atlassian · Jan 20, 2026Atlassian Security Bulletin January 20, 2026CVE-2025-49146
• Atlassian · Aug 19, 2025Atlassian Security Bulletin August 19, 2025CVE-2025-49146
• Atlassian · Jul 15, 2025Atlassian Security Bulletin July 15, 2025CVE-2025-49146
• Atlassian · Mar 18, 2025Atlassian Security Bulletin March 18, 2025CVE-2022-31197
• Atlassian · May 21, 2024Atlassian Security Bulletin May 21, 2024CVE-2024-1597
• Atlassian · Mar 19, 2024Atlassian Security Bulletin March 19, 2024CVE-2024-1597