CVE-2022-31197 SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

What is CVE-2022-31197?

CVE-2022-31197 is a high-severity SQL injection vulnerability in Debian Debian Linux, published on 3 Aug 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue.

Weakness: CWE-89

Which versions are affected by CVE-2022-31197?

7 open source packages ship an affected version, including org.postgresql:postgresql and postgresql-jdbc-driver. It affects 3 products.

Products include Debian Debian Linux, Fedoraproject Fedora, Postgresql Postgresql Jdbc Driver.

How do I fix CVE-2022-31197?

Upgrade org.postgresql:postgresql to a fixed version for your release line: 42.2.26, 42.3.7 or 42.4.1.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-31197 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31197 exists.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALSA-2023:0318, BIT-postgresql-jdbc-driver-2022-31197, CLEANSTART-2026-IG03910, DEBIAN-CVE-2022-31197, DLA-3140-1, GHSA-r38f-c4h4-hqq2 and 12 more.