The bug resides in the PostgreSQL JDBC driver, where a malicious server can instruct a client during SCRAM‑SHA‑256 authentication to use an extremely high PBKDF2 iteration count. The driver dutifully executes the iteration count without bounds, causing the client to spend an unbounded amount of CPU time in the PBKDF2 routine before the authentication fails. One such attempt consumes an entire CPU core; repeated or concurrent attempts can tie up all available cores, effectively halting application traffic or stalling connection pools. This flaw is a classic example of uncontrolled resource consumption (CWE‑770).

The vulnerability affects the pgjdbc driver from version 42.2.0 through the pre‑42.7.11 releases. The fix was introduced in release 42.7.11. Any application that depends on the vulnerable JDBC driver when connecting to a PostgreSQL server capable of dictating SCRAM iteration count is at risk.

The CVSS score of 7.5 reflects a high impact denial‑of‑service flaw. EPSS is unavailable, and the issue is not listed as a known exploited vulnerability in CISA KEV. An attacker requires control over the PostgreSQL server that the client connects to; by sending an authentication challenge with a huge iteration count the server forces the client to spend excessive CPU cycles. Because the driver performs the work in a worker thread that continues after the login timeout expires, the attack is not mitigated by connection‑timeout settings. In environments that rely on connection pools or high‑throughput services, this flaw can degrade performance or cause outages with repeated execution.