Skip to content
OpenAdvisories
High ELSA-2026-25030 1 CVE

Important: postgresql-jdbc security update (Oracle Linux 8)

Published Jun 10, 2026 · Updated Jun 10, 2026

Ecosystem: Oracle Linux

Summary

[42.2.14-4]
- Limit SCRAM PBKDF2 iterations to prevent DoS via malicious server
- Resolves: CVE-2026-42198

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 8 postgresql-jdbc 0:42.2.14-4.el8_10
Oracle Linux · 8 postgresql-jdbc-javadoc 0:42.2.14-4.el8_10

Vulnerabilities 1

  • High 7.5
    CVE-2026-42198

    pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

    pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentica…

    pgjdbc pgjdbc druid thingsboard-tb-node Debian Ubuntu Wolfi Maven