# org.postgresql:postgresql (Maven) vulnerabilities 10 known vulnerabilities (1 critical, 5 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 42.7.14 (Oct 7, 2026): no advisory affects it - Newest unaffected release: 42.7.14 (Oct 7, 2026), the latest release - Dependents: 882 - Releases: 204 since 9.2-1002-jdbc4 (Apr 5, 2013) - Registry: https://central.sonatype.com/artifact/org.postgresql/postgresql - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-54291: 42.7.4 to 42.7.11 (42.7.12 is outside it) - CVE-2026-42198: 42.2.0 to 42.7.10 (42.7.11 is outside it) - CVE-2025-49146: 42.7.4 to 42.7.6 (42.7.7 is outside it) - CVE-2024-1597: 9.2-1002-jdbc4 to 42.2.27.jre7 (42.2.28 is outside it); 42.3.0 to 42.3.8 (42.3.9 is outside it); 42.4.0 to 42.4.3 (42.4.4 is outside it); 42.5.0 to 42.5.4 (42.5.5 is outside it); 42.6.0 (42.6.1 is outside it); 42.7.0 to 42.7.1 (42.7.2 is outside it) - CVE-2022-41946: 42.2.0 to 42.2.26.jre7 (42.2.27 is outside it); 42.3.0 to 42.3.7 (42.3.8 is outside it); 42.4.0 to 42.4.2 (42.4.3 is outside it); 42.5.0 (42.5.1 is outside it) - CVE-2022-31197: 9.2-1002-jdbc4 to 42.2.25.jre7 (42.2.26 is outside it); 42.3.0 to 42.3.6 (42.3.7 is outside it); 42.4.0 (42.4.1 is outside it) - CVE-2022-26520: 42.1.0 to 42.3.2 (42.3.3 is outside it) - CVE-2022-21724: 9.4.1208 to 42.2.24.jre7 (42.2.25 is outside it); 42.3.0 to 42.3.1 (42.3.2 is outside it) - CVE-2020-13692: 9.4.1212.jre6 to 42.2.12.jre7 (42.2.13 is outside it) - CVE-2012-1618: no published release is affected ## Advisories (10) ### [CVE-2026-54291](https://cve.now/CVE-2026-54291): Silent channel-binding authentication downgrade via unsupported certificate algorithms - Severity: High 8.2 - Published: Jul 6, 2026 - Affected: from 42.7.4, fixed in 42.7.12. - Fixed in 42.7.12 (released Jun 29, 2026, 7 days before disclosure). - The latest release, 42.7.14, is not affected. ### [CVE-2026-42198](https://cve.now/CVE-2026-42198): pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS - Severity: High 7.5 - Published: Apr 29, 2026 - Affected: from 42.2.0, fixed in 42.7.11. - Fixed in 42.7.11 (released Apr 28, 2026, 1 day before disclosure). - The latest release, 42.7.14, is not affected. ### [CVE-2025-49146](https://cve.now/CVE-2025-49146): pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration - Severity: High 8.2 - Published: Jun 11, 2025 - Affected: from 42.7.4, fixed in 42.7.7. - Fixed in 42.7.7 (released Jun 11, 2025, the day of disclosure). - The latest release, 42.7.14, is not affected. ### [CVE-2024-1597](https://cve.now/CVE-2024-1597): pgjdbc SQL Injection via line comment generation - Severity: Critical 10.0 - Published: Feb 19, 2024 - Affected: fixed in 42.2.28; from 42.3.0, fixed in 42.3.9; from 42.4.0, fixed in 42.4.4; from 42.5.0, fixed in 42.5.5; from 42.6.0, fixed in 42.6.1; from 42.7.0, fixed in 42.7.2. - Fixed in 42.2.28 (released Feb 21, 2024, 2 days after disclosure), 42.3.9 (released Feb 21, 2024, 2 days after disclosure), 42.4.4 (released Feb 21, 2024, 2 days after disclosure) and 3 other versions. - The latest release, 42.7.14, is not affected. ### [CVE-2022-41946](https://cve.now/CVE-2022-41946): TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc - Severity: Medium 4.7 - Published: Nov 23, 2022 - Affected: from 42.2.0, fixed in 42.2.27; from 42.3.0, fixed in 42.3.8; from 42.4.0, fixed in 42.4.3; from 42.5.0, fixed in 42.5.1. - Fixed in 42.2.27 (released Nov 23, 2022, the day of disclosure), 42.3.8 (released Nov 23, 2022, the day of disclosure), 42.4.3 (released Nov 23, 2022, the day of disclosure) and 1 other version. - The latest release, 42.7.14, is not affected. ### [CVE-2022-31197](https://cve.now/CVE-2022-31197): SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc - Severity: High 7.1 - Published: Aug 3, 2022 - Affected: fixed in 42.2.26; from 42.4.0, fixed in 42.4.1; from 42.3.0, fixed in 42.3.7. - Fixed in 42.2.26 (released Aug 3, 2022, the day of disclosure), 42.3.7 (released Sep 6, 2022, 34 days after disclosure) and 42.4.1 (released Aug 3, 2022, the day of disclosure). - The latest release, 42.7.14, is not affected. ### [CVE-2022-26520](https://cve.now/CVE-2022-26520): In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to… - Severity: Unrated - Published: Mar 7, 2022 - Affected: from 42.1.0, fixed in 42.3.3. - Fixed in 42.3.3 (released Feb 15, 2022, 20 days before disclosure). - The latest release, 42.7.14, is not affected. ### [CVE-2022-21724](https://cve.now/CVE-2022-21724): Unchecked Class Instantiation when providing Plugin Classes - Severity: High 7.0 - Published: Feb 2, 2022 - Affected: from 9.4.1208, fixed in 42.2.25; from 42.3.0, fixed in 42.3.2. - Fixed in 42.2.25 (released Feb 1, 2022, 1 day before disclosure) and 42.3.2 (released Feb 1, 2022, 1 day before disclosure). - The latest release, 42.7.14, is not affected. ### [CVE-2020-13692](https://cve.now/CVE-2020-13692): PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. - Severity: Unrated - Published: Jun 4, 2020 - Affected: from 9.4.1212.jre6, fixed in 42.2.13. - Fixed in 42.2.13 (released Jun 4, 2020, the day of disclosure). - The latest release, 42.7.14, is not affected. ### [CVE-2012-1618](https://cve.now/CVE-2012-1618): Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard\_conforming\_strings"… - Severity: Unrated - Published: Oct 6, 2012 - Affected: fixed in 8.2. - Fixed in 9.2-1002-jdbc4 (released Apr 5, 2013, 181 days after disclosure, the advisory names 8.2, which was never published). - The latest release, 42.7.14, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.postgresql:postgresql Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.