Description
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft JDBC Driver for SQL Server 10.2 | 1.0.0 – < 10.2.4 | 10.2.4 |
| Microsoft | Microsoft JDBC Driver for SQL Server 11.2 | 1.0.0 – < 11.2.4 | 11.2.4 |
| Microsoft | Microsoft JDBC Driver for SQL Server 12.10 | 1.0.0 – < 12.10.2 | 12.10.2 |
| Microsoft | Microsoft JDBC Driver for SQL Server 12.2 | 1.0.0 – < 12.2.1 | 12.2.1 |
| Microsoft | Microsoft JDBC Driver for SQL Server 12.4 | 1.0.0 – < 12.4.3 | 12.4.3 |
| Microsoft | Microsoft JDBC Driver for SQL Server 12.6 | 1.0.0 – < 12.6.5 | 12.6.5 |
| Microsoft | Microsoft JDBC Driver for SQL Server 12.8 | 1.0.0 – < 12.8.2 | 12.8.2 |
| Microsoft | Microsoft JDBC Driver for SQL Server 13.2 | 1.0.0 – < 13.2.1 | 13.2.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apicurio-registry +2 | 3.1.4-r2 | — |
| Wolfi rolling | dependency-track | 4.13.6-r0 | — |
| Wolfi rolling | flyway | 11.15.0-r1 | — |
| Wolfi rolling | keycloak-26.4-iamguarded-compat | 26.4.7-r0 | — |
| Wolfi rolling | tez | 0.10.5-r7 | — |
| Wolfi rolling | trino-plugin-sqlserver | 478-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.microsoft.sqlserver:mssql-jdbc | >= 8.3.0.jre11-preview, < 10.2.4.jre11 | 10.2.4.jre11 | GHSA-m494-w24q-6f7w |
| Maven | com.microsoft.sqlserver:mssql-jdbc | >= 11.2.0.jre11, < 11.2.4.jre11 | 11.2.4.jre11 | GHSA-m494-w24q-6f7w |
| Maven | com.microsoft.sqlserver:mssql-jdbc | >= 12.2.0.jre11, < 12.2.1.jre11 | 12.2.1.jre11 | GHSA-m494-w24q-6f7w |
| Maven | com.microsoft.sqlserver:mssql-jdbc | >= 12.6.0.jre11, < 12.6.5.jre11 | 12.6.5.jre11 | GHSA-m494-w24q-6f7w |
| Maven | com.microsoft.sqlserver:mssql-jdbc | >= 12.8.0.jre11, < 12.8.2.jre11 | 12.8.2.jre11 | GHSA-m494-w24q-6f7w |
| Maven | com.microsoft.sqlserver:mssql-jdbc | >= 12.10.0.jre11, < 12.10.2.jre11 | 12.10.2.jre11 | GHSA-m494-w24q-6f7w |
| Maven | com.microsoft.sqlserver:mssql-jdbc | >= 13.2.0.jre11, < 13.2.1.jre11 | 13.2.1.jre11 | GHSA-m494-w24q-6f7w |
Advisories 5
- WID-SEC-2026-2451 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 2, 2026
- NCSC-2026-0021 Kwetsbaarheden verholpen in Oracle Database Server producten NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2025-2281 Microsoft JDBC Driver for SQL Server: Schwachstelle ermöglicht Darstellen falscher Informationen BSI CERT-Bund (WID) · Jan 19, 2026
- NCSC-2025-0316 Kwetsbaarheid verholpen in Microsoft SQL Server NCSC-NL (Netherlands) · Oct 14, 2025
- MSRC-CVE-2025-59250 JDBC Driver for SQL Server Spoofing Vulnerability Microsoft Security Response Center · Oct 14, 2025
References
- JDBC Driver for SQL Server Spoofing Vulnerability vendor-advisory patch