Resource exhaustion in Pgjdbc

CVE-2026-42198

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.041 (90.4th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 90.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-42198: rose from 0.033 to 0.041.

EPSS over last 30 days · oldest: 0.033 · newest: 0.041 · change: +0.009

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-42198?
CVE-2026-42198 is a high-severity vulnerability in Pgjdbc, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2026-04-29.
How severe is CVE-2026-42198?
High severity. CVSS v3 base score is 7.5 out of 10.