CVE-2025-49146 pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
Attackers can bypass channel binding requirements in the PostgreSQL JDBC driver, enabling man-in-the-middle attacks on secure connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-49146?
CVE-2025-49146 is a high-severity vulnerability in pgjdbc, published on 11 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.
Weakness: CWE-287
Which versions are affected by CVE-2025-49146?
3 open source packages ship an affected version, including org.postgresql:postgresql and postgresql-jdbc-driver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.postgresql:postgresql Maven | From 42.7.4 | 42.7.7 |
org.postgresql:postgresql Maven | From 42.7.4 | 42.7.7 |
postgresql-jdbc-driver Bitnami | From 42.7.4 | 42.7.7 |
Linux distribution packages (1)
postgresql-jdbc openSUSE:Tumbleweed | All versions | 42.7.7-1.1 |
Products include Postgresql Postgresql Jdbc Driver.
How do I fix CVE-2025-49146?
Upgrade org.postgresql:postgresql to 42.7.7 or later.
Is CVE-2025-49146 being exploited?
There is no known exploitation of CVE-2025-49146 in the wild and no public exploit code.
Other vulnerabilities in pgjdbc
Sources
Also known as BIT-postgresql-jdbc-driver-2025-49146, CLEANSTART-2026-XL50889, CLEANSTART-2026-XW89737, DEBIAN-CVE-2025-49146, GHSA-hq9p-pm7w-8p54, MINI-g73j-m8fr-9j3r and 3 more.