Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.postgresql:postgresql

10 known vulnerabilities (1 critical, 5 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
42.7.14 (Oct 7, 2026): no advisory affects it
Newest unaffected release
42.7.14 (Oct 7, 2026), the latest release
Advisories
10 · 1 critical, 5 high, 1 medium
Dependents
882
Releases
204 since 9.2-1002-jdbc4 (Apr 5, 2013)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-54291
    Affects 42.7.4 to 42.7.11 (42.7.12 is outside it)
  • CVE-2026-42198
    Affects 42.2.0 to 42.7.10 (42.7.11 is outside it)
  • CVE-2025-49146
    Affects 42.7.4 to 42.7.6 (42.7.7 is outside it)
  • CVE-2024-1597
    Affects 9.2-1002-jdbc4 to 42.2.27.jre7 (42.2.28 is outside it); 42.3.0 to 42.3.8 (42.3.9 is outside it); 42.4.0 to 42.4.3 (42.4.4 is outside it); 42.5.0 to 42.5.4 (42.5.5 is outside it); 42.6.0 (42.6.1 is outside it); 42.7.0 to 42.7.1 (42.7.2 is outside it)
  • CVE-2022-41946
    Affects 42.2.0 to 42.2.26.jre7 (42.2.27 is outside it); 42.3.0 to 42.3.7 (42.3.8 is outside it); 42.4.0 to 42.4.2 (42.4.3 is outside it); 42.5.0 (42.5.1 is outside it)
  • CVE-2022-31197
    Affects 9.2-1002-jdbc4 to 42.2.25.jre7 (42.2.26 is outside it); 42.3.0 to 42.3.6 (42.3.7 is outside it); 42.4.0 (42.4.1 is outside it)
  • CVE-2022-26520
    Affects 42.1.0 to 42.3.2 (42.3.3 is outside it)
  • CVE-2022-21724
    Affects 9.4.1208 to 42.2.24.jre7 (42.2.25 is outside it); 42.3.0 to 42.3.1 (42.3.2 is outside it)
  • CVE-2020-13692
    Affects 9.4.1212.jre6 to 42.2.12.jre7 (42.2.13 is outside it)
  • CVE-2012-1618
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

  • Silent channel-binding authentication downgrade via unsupported certificate algorithms

    Affected: from 42.7.4, fixed in 42.7.12.

    Fixed in 42.7.12 (released Jun 29, 2026, 7 days before disclosure).

    The latest release, 42.7.14, is not affected.

  • pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

    Affected: from 42.2.0, fixed in 42.7.11.

    Fixed in 42.7.11 (released Apr 28, 2026, 1 day before disclosure).

    The latest release, 42.7.14, is not affected.

  • pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

    Affected: from 42.7.4, fixed in 42.7.7.

    Fixed in 42.7.7 (released Jun 11, 2025, the day of disclosure).

    The latest release, 42.7.14, is not affected.

  • CVE-2024-1597Critical 10.0

    pgjdbc SQL Injection via line comment generation

    Affected: fixed in 42.2.28; from 42.3.0, fixed in 42.3.9; from 42.4.0, fixed in 42.4.4; from 42.5.0, fixed in 42.5.5; from 42.6.0, fixed in 42.6.1; from 42.7.0, fixed in 42.7.2.

    Fixed in 42.2.28 (released Feb 21, 2024, 2 days after disclosure), 42.3.9 (released Feb 21, 2024, 2 days after disclosure), 42.4.4 (released Feb 21, 2024, 2 days after disclosure) and 3 other versions.

    The latest release, 42.7.14, is not affected.

  • CVE-2022-41946Medium 4.7

    TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc

    Affected: from 42.2.0, fixed in 42.2.27; from 42.3.0, fixed in 42.3.8; from 42.4.0, fixed in 42.4.3; from 42.5.0, fixed in 42.5.1.

    Fixed in 42.2.27 (released Nov 23, 2022, the day of disclosure), 42.3.8 (released Nov 23, 2022, the day of disclosure), 42.4.3 (released Nov 23, 2022, the day of disclosure) and 1 other version.

    The latest release, 42.7.14, is not affected.

  • SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

    Affected: fixed in 42.2.26; from 42.4.0, fixed in 42.4.1; from 42.3.0, fixed in 42.3.7.

    Fixed in 42.2.26 (released Aug 3, 2022, the day of disclosure), 42.3.7 (released Sep 6, 2022, 34 days after disclosure) and 42.4.1 (released Aug 3, 2022, the day of disclosure).

    The latest release, 42.7.14, is not affected.

  • In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to…

    Affected: from 42.1.0, fixed in 42.3.3.

    Fixed in 42.3.3 (released Feb 15, 2022, 20 days before disclosure).

    The latest release, 42.7.14, is not affected.

  • Unchecked Class Instantiation when providing Plugin Classes

    Affected: from 9.4.1208, fixed in 42.2.25; from 42.3.0, fixed in 42.3.2.

    Fixed in 42.2.25 (released Feb 1, 2022, 1 day before disclosure) and 42.3.2 (released Feb 1, 2022, 1 day before disclosure).

    The latest release, 42.7.14, is not affected.

  • PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.

    Affected: from 9.4.1212.jre6, fixed in 42.2.13.

    Fixed in 42.2.13 (released Jun 4, 2020, the day of disclosure).

    The latest release, 42.7.14, is not affected.

  • Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings"…

    Affected: fixed in 8.2.

    Fixed in 9.2-1002-jdbc4 (released Apr 5, 2013, 181 days after disclosure, the advisory names 8.2, which was never published).

    The latest release, 42.7.14, is not affected.