RHLW-2026-5920e9c5f3ada010

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-5920e9c5f3ada010.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-5920e9c5f3ada010.json
JSON Data
https://api.test.osv.dev/v1/vulns/RHLW-2026-5920e9c5f3ada010
Upstream
Published
2026-10-08T00:00:00Z
Modified
2026-10-22T00:08:31Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Lightwell Security Advisory: postgresql 42.7.3.rhlw-00001
Details

Red Hat Lightwell has released org.postgresql:postgresql 42.7.3.rhlw-00001 with a backported security fix.

CVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

This patched artifact is a drop-in replacement for org.postgresql:postgresql 42.7.3 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.postgresql:postgresql

Package

Name
org.postgresql:postgresql
Purl
pkg:maven/org.postgresql/postgresql

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
42.7.3.rhlw-00001

Affected versions

9.*
9.2-1002-jdbc4
9.2-1003-jdbc3
9.2-1003-jdbc4
9.2-1004-jdbc3
9.2-1004-jdbc4
9.2-1004-jdbc41
9.3-1100-jdbc3
9.3-1100-jdbc4
9.3-1100-jdbc41
9.3-1101-jdbc3
9.3-1101-jdbc4
9.3-1101-jdbc41
9.3-1102-jdbc3
9.3-1102-jdbc4
9.3-1102-jdbc41
9.3-1103-jdbc3
9.3-1103-jdbc4
9.3-1103-jdbc41
9.3-1104-jdbc4
9.3-1104-jdbc41
9.4-1200-jdbc4
9.4-1200-jdbc41
9.4-1201-jdbc4
9.4-1201-jdbc41
9.4-1202-jdbc4
9.4-1202-jdbc41
9.4-1202-jdbc42
9.4-1203-jdbc4
9.4-1203-jdbc41
9.4-1203-jdbc42
9.4-1204-jdbc4
9.4-1204-jdbc41
9.4-1204-jdbc42
9.4-1205-jdbc4
9.4-1205-jdbc41
9.4-1205-jdbc42
9.4-1206-jdbc4
9.4-1206-jdbc41
9.4-1206-jdbc42
9.4.1207
9.4.1207.jre6
9.4.1207.jre7
9.4.1208
9.4.1208.jre6
9.4.1208.jre7
9.4.1209
9.4.1209.jre6
9.4.1209.jre7
9.4.1210
9.4.1210.jre6
9.4.1210.jre7
9.4.1211
9.4.1211.jre6
9.4.1211.jre7
9.4.1212
9.4.1212.jre6
9.4.1212.jre7
42.*
42.0.0
42.0.0.jre6
42.0.0.jre7
42.1.0
42.1.0.jre7
42.1.1
42.1.1.jre6
42.1.1.jre7
42.1.2
42.1.2.jre6
42.1.2.jre7
42.1.3
42.1.3.jre6
42.1.3.jre7
42.1.4
42.1.4.jre6
42.1.4.jre7
42.2.0
42.2.0.jre6
42.2.0.jre7
42.2.1
42.2.1.jre6
42.2.1.jre7
42.2.2
42.2.2.jre6
42.2.2.jre7
42.2.3
42.2.3.jre6
42.2.3.jre7
42.2.4
42.2.4.jre6
42.2.4.jre7
42.2.5
42.2.5.jre6
42.2.5.jre7
42.2.6
42.2.6.jre6
42.2.6.jre7
42.2.7
42.2.7.jre6
42.2.7.jre7
42.2.8
42.2.8.jre6
42.2.8.jre7
42.2.9
42.2.9.jre6
42.2.9.jre7
42.2.10
42.2.10.jre6
42.2.10.jre7
42.2.11
42.2.11.jre6
42.2.11.jre7
42.2.12
42.2.12.jre6
42.2.12.jre7
42.2.13
42.2.13.jre6
42.2.13.jre7
42.2.14
42.2.14.jre6
42.2.14.jre7
42.2.15
42.2.15.jre6
42.2.15.jre7
42.2.16
42.2.16.jre6
42.2.16.jre7
42.2.17
42.2.17.jre6
42.2.17.jre7
42.2.18
42.2.18.jre6
42.2.18.jre7
42.2.19
42.2.19.jre6
42.2.19.jre7
42.2.20
42.2.20.jre6
42.2.20.jre7
42.2.21
42.2.21.jre6
42.2.21.jre7
42.2.22
42.2.22.jre6
42.2.22.jre7
42.2.23
42.2.23.jre6
42.2.23.jre7
42.2.24
42.2.24.jre6
42.2.24.jre7
42.2.25
42.2.25.jre6
42.2.25.jre7
42.2.26
42.2.26.jre6
42.2.26.jre7
42.2.27
42.2.27.jre6
42.2.27.jre7
42.2.28
42.2.28.jre7
42.2.29
42.2.29.jre7
42.3.0
42.3.1
42.3.2
42.3.3
42.3.4
42.3.5
42.3.6
42.3.7
42.3.8
42.3.9
42.3.10
42.4.0
42.4.1
42.4.2
42.4.3
42.4.4
42.4.5
42.5.0
42.5.1
42.5.2
42.5.3
42.5.4
42.5.5
42.5.6
42.6.0
42.6.1
42.6.2
42.7.0
42.7.1
42.7.2
42.7.3

Database specific

lightwell 
{
    "backport_base_version": "42.7.3",
    "remediated_version": "42.7.3.rhlw-00001",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-5920e9c5f3ada010.json"