CVE-2026-42198 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

High 7.5 Published 29 Apr 2026 Updated 11 Sep 2026

A malicious server can cause client-side CPU exhaustion in the PostgreSQL JDBC driver during SCRAM authentication, leading to denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-42198?

CVE-2026-42198 is a high-severity denial of service vulnerability in pgjdbc, published on 29 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Weakness: CWE-770

Which versions are affected by CVE-2026-42198?

3 open source packages ship an affected version, including org.postgresql:postgresql and postgresql-jdbc-driver. It affects 1 product.

Package	Affected	Fixed in
`org.postgresql:postgresql` Maven	From `42.2.0`	`42.7.11`
`org.postgresql:postgresql` Maven	From `42.2.0`	`42.7.11`
`postgresql-jdbc-driver` Bitnami	From `42.2.0`	`42.7.11`

Linux distribution packages (30)

`postgresql-jdbc` AlmaLinux:10	All versions	`42.7.2-1.el10_2.2`
`postgresql-jdbc` AlmaLinux:8	All versions	`42.2.14-4.el8_10`
`postgresql-jdbc-javadoc` AlmaLinux:8	All versions	`42.2.14-4.el8_10`
`postgresql-jdbc` AlmaLinux:9	All versions	`42.2.28-2.el9_8.2`
`postgresql-jdbc` Red Hat:enterprise_linux:10.2	All versions	`0:42.7.2-1.el10_2.2`
`postgresql-jdbc` Red Hat:enterprise_linux:8::appstream	All versions	`0:42.2.14-4.el8_10`
`postgresql-jdbc-javadoc` Red Hat:enterprise_linux:8::appstream	All versions	`0:42.2.14-4.el8_10`
`postgresql-jdbc` Red Hat:enterprise_linux:9::appstream	All versions	`0:42.2.28-2.el9_8.2`
`postgresql-jdbc` Red Hat:enterprise_linux_eus:10.0	All versions	`0:42.7.1-7.el10_0.1`
`postgresql-jdbc` Red Hat:rhel_aus:8.4::appstream	All versions	`0:42.2.3-7.el8_4.1`
`postgresql-jdbc-javadoc` Red Hat:rhel_aus:8.4::appstream	All versions	`0:42.2.3-7.el8_4.1`
`postgresql-jdbc` Red Hat:rhel_aus:8.6::appstream	All versions	`0:42.2.3-5.el8_6.1`
`postgresql-jdbc-javadoc` Red Hat:rhel_aus:8.6::appstream	All versions	`0:42.2.3-5.el8_6.1`
`postgresql-jdbc` Red Hat:rhel_e4s:8.8::appstream	All versions	`0:42.2.14-5.el8_8.1`
`postgresql-jdbc-javadoc` Red Hat:rhel_e4s:8.8::appstream	All versions	`0:42.2.14-5.el8_8.1`
`postgresql-jdbc` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:42.2.28-1.el9_2.1`
`postgresql-jdbc` Red Hat:rhel_e4s:9.4::appstream	All versions	`0:42.2.28-1.el9_4.1`
`postgresql-jdbc` Red Hat:rhel_eus:9.6::appstream	All versions	`0:42.2.28-1.el9_6.1`
`postgresql-jdbc` Red Hat:rhel_eus_long_life:8.4::appstream	All versions	`0:42.2.3-7.el8_4.1`
`postgresql-jdbc-javadoc` Red Hat:rhel_eus_long_life:8.4::appstream	All versions	`0:42.2.3-7.el8_4.1`
`postgresql-jdbc` Red Hat:rhel_eus_long_life:8.6::appstream	All versions	`0:42.2.3-5.el8_6.1`
`postgresql-jdbc-javadoc` Red Hat:rhel_eus_long_life:8.6::appstream	All versions	`0:42.2.3-5.el8_6.1`
`postgresql-jdbc` Red Hat:rhel_tus:8.8::appstream	All versions	`0:42.2.14-5.el8_8.1`
`postgresql-jdbc-javadoc` Red Hat:rhel_tus:8.8::appstream	All versions	`0:42.2.14-5.el8_8.1`
`postgresql-jdbc` Rocky Linux:10	All versions	`0:42.7.2-1.el10_2.2`
`postgresql-jdbc` Rocky Linux:8	All versions	`0:42.2.14-4.el8_10`
`postgresql-jdbc` Rocky Linux:9	All versions	`0:42.2.28-2.el9_8.2`
`postgresql-jdbc` SUSE:Linux Enterprise Server 16.0	All versions	`42.7.7-160000.3.1`
`postgresql-jdbc` SUSE:Linux Enterprise Server for SAP applications 16.0	All versions	`42.7.7-160000.3.1`
`postgresql-jdbc` openSUSE:Tumbleweed	All versions	`42.7.11-1.1`

Products include Postgresql Postgresql Jdbc Driver.

How do I fix CVE-2026-42198?

Upgrade org.postgresql:postgresql to 42.7.11 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-42198 being exploited?

There is no known exploitation of CVE-2026-42198 in the wild and no public exploit code.

Sources

Also known as ALSA-2026:22304, ALSA-2026:24348, ALSA-2026:25030, BIT-postgresql-jdbc-driver-2026-42198, CLEANSTART-2026-FS84990, CLEANSTART-2026-IB51181 and 46 more.