CVE-2025-49146
1 advisory.
Maven/org.postgresql:postgresql CVE-2025-49146: high 8.2
pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
Action: Upgrade org.postgresql:postgresql to 42.7.7 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 42.7.4 | 42.7.7 | - |
Fixed versions
| 42.7.7 |
Sources
- osv: GHSA-hq9p-pm7w-8p54
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54
- https://nvd.nist.gov/vuln/detail/CVE-2025-49146
- https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0
- https://datatracker.ietf.org/doc/html/rfc5802
- https://datatracker.ietf.org/doc/html/rfc7677
- https://github.com/pgjdbc/pgjdbc
- https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256
CVE-2025-49146 · published · modified · JSON