By vendor

Postgresql vulnerabilities

Known CVEs affecting Postgresql products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-54291MEDIUM 5.9

  pgjdbc, the official PostgreSQL JDBC driver, contains a flaw in versions 42.7.4 through 42.7.11 where connections explicitly configured to require channel binding security (channelBinding=require) can be silently downgraded to a weaker authentication method. An attacker positioned to intercept TLS traffic can force this downgrade by presenting a certificate with an unsupported signature algorithm, causing the driver to drop the man-in-the-middle protection that channel binding provides. The vulnerability stems from incomplete validation: the driver checks only that the server advertises a secure mechanism but fails to reject empty or missing channel-binding data. Version 42.7.12 and later fix this issue.