CVE-2024-1597criticalobserved exploitationCWE-89

CVE-2024-1597: critical vulnerability in pgjdbc

pgjdbc SQL Injection via line comment generation

Published · Updated

Follow this CVE+ Monitor pgjdbc+ Monitor libpgjava

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 10epss 4.8%
from disclosure to weapon
Published on NVDFeb 19
VulnCheck+254d
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
pgjdbc · pgjdbc
Related CVEs — pgjdbc

In the same product, most dangerous first.

CVE-2026-42198HIGHpgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoSEPSS 3.3%CVE-2022-31197HIGHSQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbcEPSS 2.4%CVE-2022-41946MEDIUMTemporaryFolder on unix-like systems does not limit access to created files in pgjdbcEPSS 0.6%CVE-2025-49146HIGHpgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require ConfigurationEPSS 0.5%CVE-2026-107314MEDIUMpgjdbc does not enforce requireAuth when the value excludes every authentication methodEPSS 0.3%CVE-2026-54291HIGHSilent channel-binding authentication downgrade via unsupported certificate algorithmsEPSS 0.2%