pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.
References
| Link | Resource |
|---|---|
| https://github.com/ongres/scram/releases/tag/3.3 | Not Applicable |
| https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99 | Patch |
| https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867 | Patch Vendor Advisory |
Configurations
History
09 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.9 |
| CPE | cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* | |
| First Time |
Postgresql postgresql Jdbc Driver
Postgresql |
|
| References | () https://github.com/ongres/scram/releases/tag/3.3 - Not Applicable | |
| References | () https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99 - Patch | |
| References | () https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867 - Patch, Vendor Advisory |
06 Jul 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-06 19:17
Updated : 2026-07-09 13:16
NVD link : CVE-2026-54291
Mitre link : CVE-2026-54291
CVE.ORG link : CVE-2026-54291
JSON object : View
Products Affected
postgresql
- postgresql_jdbc_driver