CVE-2025-49146: fallo de gravedad alta en pgjdbc
pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.2epss 0.5%
pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Productos afectados
pgjdbc · pgjdbcCVEs relacionadas — pgjdbc
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-1597CRITICALpgjdbc SQL Injection via line comment generationEPSS 4.8%CVE-2026-42198HIGHpgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoSEPSS 3.3%CVE-2022-31197HIGHSQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbcEPSS 2.4%CVE-2022-41946MEDIUMTemporaryFolder on unix-like systems does not limit access to created files in pgjdbcEPSS 0.6%CVE-2026-107314MEDIUMpgjdbc does not enforce requireAuth when the value excludes every authentication methodEPSS 0.3%CVE-2026-54291HIGHSilent channel-binding authentication downgrade via unsupported certificate algorithmsEPSS 0.2%