Postgresql Postgresql_jdbc_driver
11 CVEs affecting Postgresql Postgresql_jdbc_driver. Latest disclosed: 2026-07-06. Critical: 2, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1597 | Critical | 10.0 | 2024-02-19 | pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is n… |
CVE-2022-26520 | Critical | 9.8 | 2022-03-10 | In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the l… |
CVE-2025-49146 | High | 8.2 | 2025-06-11 | pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to requir… |
CVE-2018-10936 | High | 8.1 | 2018-08-30 | A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier wa… |
CVE-2020-13692 | High | 7.7 | 2020-06-04 | PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. |
CVE-2026-42198 | High | 7.5 | 2026-04-29 | pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during… |
CVE-2022-31197 | High | 7.1 | 2022-08-03 | PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC i… |
CVE-2022-21724 | High | 7.0 | 2022-02-02 | pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system us… |
CVE-2026-54291 | Medium | 5.9 | 2026-07-06 | pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-S… |
CVE-2022-41946 | Medium | 4.7 | 2022-11-23 | pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `Prepa… |
CVE-2012-1618 | | 2012-10-06 | Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as t… |