CVE-2026-107313

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos. The stored value then holds bytes of the messages the driver sent just before it on the same connection, such as the statement's SQL text, its other parameters, and earlier rows of the same batch, instead of the bytes the application supplied. Values at least as long as the buffer are affected when the driver writes them from a byte array: bind parameters set with setString, setBytes, or a ByteStreamWriter, CopyIn.writeToCopy, and LargeObject.write. Most such writes fail with an ArrayIndexOutOfBoundsException instead. The default, gssEncMode=allow, does not start GSS encryption, and connections without GSS encryption are not affected. Versions 42.7.3 and earlier are not affected, and 42.7.6 fixes the problem.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb
https://github.com/pgjdbc/pgjdbc/pull/3500
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hggc-j2qh-988m
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hggc-j2qh-988m

Configurations

No configuration.

History

07 Oct 2026, 21:17

Type	Values Removed	Values Added
References	~~() https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hggc-j2qh-988m -~~	() https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hggc-j2qh-988m -

07 Oct 2026, 19:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-07 19:17

Updated : 2026-10-08 20:49

NVD link : CVE-2026-107313

Mitre link : CVE-2026-107313

CVE.ORG link : CVE-2026-107313

JSON object : View

Products Affected

No product.

CWE

CWE-201

Insertion of Sensitive Information Into Sent Data

{"id": "CVE-2026-107313", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107313", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T20:35:21.062505Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}]}, "affected": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "affectedData": [{"repo": "https://github.com/pgjdbc/pgjdbc", "vendor": "pgjdbc", "product": "pgjdbc", "versions": [{"status": "affected", "version": "42.7.4", "lessThan": "42.7.6", "versionType": "maven"}], "packageName": "org.postgresql:postgresql", "programFiles": ["pgjdbc/src/main/java/org/postgresql/gss/GSSOutputStream.java"], "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "programRoutines": [{"name": "org.postgresql.gss.GSSOutputStream.writeWrapped"}]}]}], "published": "2026-10-07T19:17:35.513", "references": [{"url": "https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}, {"url": "https://github.com/pgjdbc/pgjdbc/pull/3500", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}, {"url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hggc-j2qh-988m", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}, {"url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hggc-j2qh-988m", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "description": [{"lang": "en", "value": "CWE-201"}]}], "descriptions": [{"lang": "en", "value": "pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos. The stored value then holds bytes of the messages the driver sent just before it on the same connection, such as the statement's SQL text, its other parameters, and earlier rows of the same batch, instead of the bytes the application supplied. Values at least as long as the buffer are affected when the driver writes them from a byte array: bind parameters set with setString, setBytes, or a ByteStreamWriter, CopyIn.writeToCopy, and LargeObject.write. Most such writes fail with an ArrayIndexOutOfBoundsException instead. The default, gssEncMode=allow, does not start GSS encryption, and connections without GSS encryption are not affected. Versions 42.7.3 and earlier are not affected, and 42.7.6 fixes the problem."}], "lastModified": "2026-10-08T20:49:23.240", "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}