The PostgreSQL JDBC driver pads a value that is shorter than its declared length with leftover bytes from earlier messages on the same connection rather than zeros. These residues can include SQL text and parameter values from previous statements, up to 8 KB or 16 KB when GSS encryption is used. The driver accepts the mismatched length silently, allowing an attacker who can influence an application to write such a value and later read it back to retrieve previously sent traffic. This is an information‑leak flaw that compromises confidentiality of data that should be protected.

Affected systems are installations of the PostgreSQL JDBC driver with version numbers 42.7.4 through 42.7.13. These releases adopt byte‑padding from earlier connection traffic. Versions 42.7.3 and earlier pad with zeros and are unaffected.

Risk assessment places the vulnerability at a CVSS score of 5.3, indicating moderate severity. The EPSS score of < 1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. It is exploitable via any application that declares a length longer than the supplied byte data, such as PreparedStatement.setObject, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes. The attack requires the adversary to control or influence the application to store a padded value and later read it back to retrieve previously sent traffic.