CVE-2024-1597 is a critical (CVSS 10.0) SQL injection in the PostgreSQL JDBC Driver, pgjdbc. It applies only when the non-default PreferQueryMode=SIMPLE is used and specific query shapes exist. Fixed in 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9 and 42.2.28. The default mode is not vulnerable.
What's affected
The GitHub advisory GHSA-24rp-q3w6-vc56, published on 21 February 2024, lists the Maven package org.postgresql:postgresql with these affected and patched versions:
- before 42.2.28, patched in 42.2.28 (and 42.2.28.jre7)
- before 42.3.9, patched in 42.3.9
- before 42.4.4, patched in 42.4.4
- before 42.5.5, patched in 42.5.5
- before 42.6.1, patched in 42.6.1
- before 42.7.2, patched in 42.7.2
The advisory labels it Critical and the record scores it 10.0, so they agree. The record also lists Fedora packages.
Two conditions limit real exposure. The application must set preferQueryMode to simple, which is not the default. And its SQL must negate a parameter value in a certain way, with two user-controlled placeholders on one line.
How to check if you're exposed
Find the driver version in a Maven project:
mvn dependency:tree -Dincludes=org.postgresql:postgresql
For Gradle, use gradle dependencies and search for postgresql. Then search your code and configuration for the non-default setting:
grep -rni "preferQueryMode" .
If you never set the property to simple, the advisory says the driver is not impacted, but upgrading is still sensible.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- List every service that depends on org.postgresql:postgresql and its version.
- Upgrade to the patched release for your line.
- Search configuration and connection strings for preferQueryMode=simple.
- Review queries that put a negated numeric parameter before a string parameter.
- Rebuild and redeploy services, including shaded or bundled copies of the driver.
Why it matters
The record classes this as CWE-89, SQL injection. In simple mode the driver substitutes parameter values into the SQL text itself. A negative number placed after a minus sign produced a line comment marker, and that comment swallowed the quoting of the next parameter, so a crafted string could become SQL.
This is notable because parameterized queries are the standard defense against injection. Here a driver quirk undid it under narrow conditions. The 10.0 score is the worst case, and your actual risk depends on the two conditions above. Reachability analysis helps here, because it can tell you whether code paths use the vulnerable pattern. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I vulnerable with default settings?
The advisory says there is no vulnerability in the driver when using the default query mode.
What makes the query shape vulnerable?
A numeric placeholder directly after a minus, followed by a string placeholder on the same line, both user controlled.
Sources
- GitHub advisory GHSA-24rp-q3w6-vc56
- oss-security post (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1597
Last reviewed: 19 October 2026.
