Skip to content
OpenAdvisories
High ELSA-2026-24348 1 CVE

Important: postgresql-jdbc security update (Oracle Linux 10)

Published Jul 16, 2026 · Updated Jul 16, 2026

Ecosystem: Oracle Linux

Summary

[42.7.2-1.2]
- Add tests for CVE-2026-42198

[42.7.2-1.1]
- Limit SCRAM PBKDF2 iterations to prevent DoS via malicious server
- Resolves: RHEL-173479

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 10 postgresql-jdbc 0:42.7.2-1.el10_2.2

Vulnerabilities 1

  • High 7.5
    CVE-2026-42198

    pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

    pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentica…

    pgjdbc pgjdbc druid thingsboard-tb-node Debian Ubuntu Wolfi Maven