Skip to content
OpenAdvisories
High ELSA-2026-22304 1 CVE

Important: postgresql-jdbc security update (Oracle Linux 9)

Published Jun 23, 2026 · Updated Jun 23, 2026

Ecosystem: Oracle Linux

Summary

[42.2.28-2.2]
- Add tests for CVE-2026-42198

[42.2.28-2.1]
- Fix CVE-2026-42198: limit SCRAM PBKDF2 iterations to prevent DoS
- Resolves: RHEL-173489

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 postgresql-jdbc 0:42.2.28-2.el9_8.2

Vulnerabilities 1

  • High 7.5
    CVE-2026-42198

    pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

    pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentica…

    pgjdbc pgjdbc druid thingsboard-tb-node Debian Ubuntu Wolfi Maven