CVE-2024-1597 pgjdbc SQL Injection via line comment generation

Critical 10.0 Published 19 Feb 2024 Updated 3 Nov 2025

Attackers can inject SQL via crafted numeric and string placeholders when PreferQueryMode is set to SIMPLE, bypassing parameterized query protections.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-1597?

CVE-2024-1597 is a critical SQL injection vulnerability in Fedoraproject Fedora, published on 19 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.

Weakness: CWE-89

Which versions are affected by CVE-2024-1597?

13 open source packages ship an affected version, including org.postgresql:postgresql and postgresql-jdbc-driver. It affects 2 products.

Package	Affected	Fixed in
`org.postgresql:postgresql` Maven	All versions	`42.2.28`
`org.postgresql:postgresql` Maven	All versions	`42.2.28`
`org.postgresql:postgresql` Maven	From `42.3.0`	`42.3.9`
`org.postgresql:postgresql` Maven	From `42.3.0`	`42.3.9`
`org.postgresql:postgresql` Maven	From `42.4.0`	`42.4.4`
`org.postgresql:postgresql` Maven	From `42.4.0`	`42.4.4`

7 more packages

`org.postgresql:postgresql` Maven	From `42.5.0`	`42.5.5`
`org.postgresql:postgresql` Maven	From `42.5.0`	`42.5.5`
`org.postgresql:postgresql` Maven	From `42.6.0`	`42.6.1`
`org.postgresql:postgresql` Maven	From `42.6.0`	`42.6.1`
`org.postgresql:postgresql` Maven	From `42.7.0`	`42.7.2`
`org.postgresql:postgresql` Maven	From `42.7.0`	`42.7.2`
`postgresql-jdbc-driver` Bitnami	All versions	`42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2`

Linux distribution packages (27)

`postgresql-jdbc` AlmaLinux:8	All versions	`42.2.14-3.el8_9`
`postgresql-jdbc-javadoc` AlmaLinux:8	All versions	`42.2.14-3.el8_9`
`postgresql-jdbc` AlmaLinux:9	All versions	`42.2.28-1.el9_3`
`postgresql-jdbc` Red Hat:enterprise_linux:8::appstream	All versions	`0:42.2.14-3.el8_9`
`postgresql-jdbc-javadoc` Red Hat:enterprise_linux:8::appstream	All versions	`0:42.2.14-3.el8_9`
`postgresql-jdbc` Red Hat:enterprise_linux:9::appstream	All versions	`0:42.2.28-1.el9_3`
`postgresql-jdbc` Red Hat:rhel_aus:8.2::appstream	All versions	`0:42.2.3-5.el8_2`
`postgresql-jdbc-javadoc` Red Hat:rhel_aus:8.2::appstream	All versions	`0:42.2.3-5.el8_2`
`postgresql-jdbc` Red Hat:rhel_aus:8.4::appstream	All versions	`0:42.2.3-7.el8_4`
`postgresql-jdbc-javadoc` Red Hat:rhel_aus:8.4::appstream	All versions	`0:42.2.3-7.el8_4`
`postgresql-jdbc` Red Hat:rhel_aus:8.6::appstream	All versions	`0:42.2.3-5.el8_6`
`postgresql-jdbc-javadoc` Red Hat:rhel_aus:8.6::appstream	All versions	`0:42.2.3-5.el8_6`
`postgresql-jdbc` Red Hat:rhel_e4s:8.2::appstream	All versions	`0:42.2.3-5.el8_2`
`postgresql-jdbc-javadoc` Red Hat:rhel_e4s:8.2::appstream	All versions	`0:42.2.3-5.el8_2`
`postgresql-jdbc` Red Hat:rhel_e4s:8.4::appstream	All versions	`0:42.2.3-7.el8_4`
`postgresql-jdbc-javadoc` Red Hat:rhel_e4s:8.4::appstream	All versions	`0:42.2.3-7.el8_4`
`postgresql-jdbc` Red Hat:rhel_e4s:8.6::appstream	All versions	`0:42.2.3-5.el8_6`
`postgresql-jdbc-javadoc` Red Hat:rhel_e4s:8.6::appstream	All versions	`0:42.2.3-5.el8_6`
`postgresql-jdbc` Red Hat:rhel_eus:8.8::appstream	All versions	`0:42.2.14-5.el8_8`
`postgresql-jdbc-javadoc` Red Hat:rhel_eus:8.8::appstream	All versions	`0:42.2.14-5.el8_8`
`postgresql-jdbc` Red Hat:rhel_eus:9.0::appstream	All versions	`0:42.2.28-1.el9_0`
`postgresql-jdbc` Red Hat:rhel_eus:9.2::appstream	All versions	`0:42.2.28-1.el9_2`
`postgresql-jdbc` Red Hat:rhel_tus:8.2::appstream	All versions	`0:42.2.3-5.el8_2`
`postgresql-jdbc-javadoc` Red Hat:rhel_tus:8.2::appstream	All versions	`0:42.2.3-5.el8_2`
`postgresql-jdbc` Red Hat:rhel_tus:8.4::appstream	All versions	`0:42.2.3-7.el8_4`
`postgresql-jdbc-javadoc` Red Hat:rhel_tus:8.4::appstream	All versions	`0:42.2.3-7.el8_4`
`postgresql-jdbc` Red Hat:rhel_tus:8.6::appstream	All versions	`0:42.2.3-5.el8_6`

Products include Fedoraproject Fedora, Postgresql Postgresql Jdbc Driver.

How do I fix CVE-2024-1597?

Upgrade org.postgresql:postgresql to a fixed version for your release line: 42.2.28, 42.3.9, 42.4.4 or 42.5.5.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-1597 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1597 exists.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALSA-2024:1435, ALSA-2024:1436, BIT-postgresql-jdbc-driver-2024-1597, CLEANSTART-2026-DW89349, CLSA-2025-1754870602, CLSA-2025-1762243790 and 24 more.