pgjdbc up to 42.7.11 ScramAuthenticator ScramAuthenticator.java authenticate channelBinding channel accessible

Summaryinfo

A vulnerability was found in pgjdbc up to 42.7.11 and classified as critical. The affected element is the function Authenticate of the file ScramAuthenticator.java of the component ScramAuthenticator. Executing a manipulation of the argument channelBinding can lead to channel accessible. This vulnerability is tracked as CVE-2026-54291. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in pgjdbc up to 42.7.11 and classified as critical. This vulnerability affects the function authenticate of the file ScramAuthenticator.java of the component ScramAuthenticator. The manipulation of the argument channelBinding with an unknown input leads to a channel accessible vulnerability. The CWE definition for the vulnerability is CWE-300. The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-54291 since 06/12/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1557.

Upgrading to version 42.7.12 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• pgjdbc

Version

• 42.7.0
• 42.7.1
• 42.7.2
• 42.7.3
• 42.7.4
• 42.7.5
• 42.7.6
• 42.7.7
• 42.7.8
• 42.7.9
• 42.7.10
• 42.7.11

Website

• Product: https://github.com/pgjdbc/pgjdbc/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion