Skip to content
Fencer Vulns
high 8.2

CVE-2025-49146 json

pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

published 2025-06-11 16 mo ago modified 2026-09-10 59 d ago also BIT-postgresql-jdbc-driver-2025-49146 , EUVD-2025-18118 , GHSA-hq9p-pm7w-8p54

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.

Patch / fix

  • maven org.postgresql:postgresql 42.7.7
  • bitnami postgresql-jdbc-driver 42.7.7
  • org.postgresql postgresql 42.7.7
  • postgresql postgresql_jdbc_driver 42.7.7
  • libpgjava Debian 14, Debian 13 42.7.7-1

debian advisories DEBIAN-CVE-2025-49146

  • postgresql-jdbc openSUSE Tumbleweed 42.7.7-1.1

opensuse advisories openSUSE-SU-2025:15264-1

  • java-postgresql-jdbc Alpine 3.24 42.7.9-r0

alpine advisories ALPINE-CVE-2025-49146

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-49146 updated cvss 8.2

pgjdbc: pgjdbc insecure authentication in channel binding

  • Red Hat build of Apicurio Registry 2 postgresql Red Hat build of Apicurio Registry 3 postgresql
    affected: workaround, no fix available
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.0.1-3, cryostat/cryostat-db-rhel9 4.0.1-5, cryostat/jfr-datasource-rhel9 4.0.1-3, cryostat/cryostat-reports-rhel9 4.0.1-3, cryostat/cryostat-storage-rhel9 4.0.1-5, cryostat/cryostat-rhel9-operator 4.0.1-5, +5 more
    fixed: vendor fix RHSA-2025:10323
  • Red Hat AMQ Broker 7.12.5
    fixed: vendor fix RHSA-2025:16409
  • Red Hat AMQ Broker 7.13.1
    fixed: vendor fix RHSA-2025:13274
  • Red Hat build of Apache Camel 4.10.3 for Spring Boot 3.4.7
    fixed: vendor fix RHSA-2025:9697
  • Red Hat build of Quarkus 3.15.6
    fixed: vendor fix RHSA-2025:13012
  • Red Hat build of Quarkus 3.20.2.redhat postgresql 42.7.7.redhat-00001
    fixed: vendor fix RHSA-2025:13010
  • Red Hat build of Debezium 2 postgresql Red Hat build of Debezium 3 postgresql Red Hat build of OptaPlanner 8 postgresql Red Hat build of Quarkus 3.20.2.redhat jna 5.8.0, lit 3.2.1, bson 5.3.1, db2 1.20.6, h2 2.3.230, y18n 5.0.8, +1017 more Red Hat Data Grid 8 postgresql Red Hat Enterprise Linux 8 Judy, galera, mariadb, mariadb-pam, mariadb-test, mariadb-backup, +10 more
    +9 more products
    Red Hat Fuse 7 postgresql Red Hat Integration Camel K 1 postgresql Red Hat JBoss Enterprise Application Platform 7 postgresql Red Hat JBoss Enterprise Application Platform 8 postgresql Red Hat JBoss Enterprise Application Platform Expansion Pack postgresql Red Hat OpenShift Dev Spaces devspaces/server-rhel8, devspaces/server-rhel9 Red Hat Process Automation 7 postgresql Red Hat Satellite 6 candlepin, postgresql, candlepin-selinux Red Hat Single Sign-On 7 postgresql
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
16 mo ago

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
GitHub 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.postgresql:postgresql
>=42.7.4, <42.7.7
42.7.7
bitnami postgresql-jdbc-driver
>=42.7.4, <42.7.7
42.7.7

Affected products

  • pgjdbc pgjdbc

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.