Description
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos. The stored value then holds bytes of the messages the driver sent just before it on the same connection, such as the statement's SQL text, its other parameters, and earlier rows of the same batch, instead of the bytes the application supplied. Values at least as long as the buffer are affected when the driver writes them from a byte array: bind parameters set with setString, setBytes, or a ByteStreamWriter, CopyIn.writeToCopy, and LargeObject.write. Most such writes fail with an ArrayIndexOutOfBoundsException instead. The default, gssEncMode=allow, does not start GSS encryption, and connections without GSS encryption are not affected. Versions 42.7.3 and earlier are not affected, and 42.7.6 fixes the problem.
Published: 2026-10-07
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Integrity Loss
Action: Patch
AI Analysis

Impact

The vulnerability in the PostgreSQL JDBC driver causes the driver to incorrectly store the first portion of a large value sent over a GSS-encrypted connection. When a value equal to or larger than the 16,320‑byte buffer is written, the buffer contents from previous messages replace that part of the value. The server then stores the corrupted data without reporting an error. The defect may lead to unexpected data being stored, potentially exposing prior SQL statements or intermediate rows in the database. The weakness is classified as CWE‑201, reflecting improper information handling.

Affected Systems

The issue affects the pgjdbc driver, specifically versions 42.7.4 and 42.7.5, which are used to connect to PostgreSQL databases over GSS‑encrypted connections. Versions 42.7.3 and earlier and 42.7.6 and later are not affected.

Risk and Exploitability

The CVSS score of 4.2 indicates low severity, and no EPSS data is available. The vulnerability is not listed in CISA KEV, and the attack requires that the application establish a GSS-enabled connection. An attacker who can supply large values may cause data corruption on the server, but the potential impact is limited to integrity of stored data and does not provide immediate code execution or privilege escalation. Due to the narrow scope and low CVSS score, the overall risk is considered low but still warrants patching.

Generated by OpenCVE AI on October 7, 2026 at 19:24 UTC.

Remediation

Vendor Solution

Upgrade to pgjdbc 42.7.6 or later.

Vendor Workaround

On 42.7.4 and 42.7.5, turn GSS encryption off with gssEncMode=disable and use TLS for transport encryption instead.

OpenCVE Recommended Actions

  • Upgrade the pgjdbc driver to version 42.7.6 or later.
  • For applications still using 42.7.4 or 42.7.5, disable GSS encryption by setting gssEncMode=disable and use TLS for transport encryption instead.
  • Avoid sending values larger than the 16,320‑byte buffer or validate data length before transmission to prevent potential corruption.

Generated by OpenCVE AI on October 7, 2026 at 19:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Pgjdbc
Pgjdbc pgjdbc
Vendors & Products Pgjdbc
Pgjdbc pgjdbc

Wed, 07 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos. The stored value then holds bytes of the messages the driver sent just before it on the same connection, such as the statement's SQL text, its other parameters, and earlier rows of the same batch, instead of the bytes the application supplied. Values at least as long as the buffer are affected when the driver writes them from a byte array: bind parameters set with setString, setBytes, or a ByteStreamWriter, CopyIn.writeToCopy, and LargeObject.write. Most such writes fail with an ArrayIndexOutOfBoundsException instead. The default, gssEncMode=allow, does not start GSS encryption, and connections without GSS encryption are not affected. Versions 42.7.3 and earlier are not affected, and 42.7.6 fixes the problem.
Title pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections
Weaknesses CWE-201
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Pgjdbc Pgjdbc
cve-icon MITRE

Status: PUBLISHED

Assigner: PostgreSQL

Published:

Updated: 2026-10-07T20:35:43.451Z

Reserved: 2026-10-07T16:53:39.433Z

Link: CVE-2026-107313

cve-icon Vulnrichment

Updated: 2026-10-07T20:35:38.942Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-07T19:17:35.513

Modified: 2026-10-08T20:49:23.240

Link: CVE-2026-107313

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-07T18:19:53Z

Links: CVE-2026-107313 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T20:15:17Z

Weaknesses
  • CWE-201

    Insertion of Sensitive Information Into Sent Data