The CVE-2026-54291 vulnerability in pgjdbc, a PostgreSQL JDBC driver, allows for a silent downgrade of SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it. This downgrade can be triggered by an attacker who can intercept the TLS connection with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash. The issue arises because the bundled com.ongres.scr [truncated]
CVE-2026-42198 is a high-severity vulnerability in the PostgreSQL JDBC Driver (pgjdbc) that allows for a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count, causing the client to spend an unbounded amount of CPU time inside PBKDF2 before authentication can fail. This issue has been [truncated]
