The PostgreSQL JDBC driver, pgjdbc, got three CVEs on 7 and 8 October 2026: CVE-2026-107313, CVE-2026-107314 and CVE-2026-107315. NVD rates them medium, from 4.2 to 5.9. The unusual part is that under certain conditions the driver writes bytes from its own earlier traffic into your database column.
What's affected
| CVE | Affected versions | Condition | NVD score |
|---|---|---|---|
| CVE-2026-107313 | 42.7.4 and 42.7.5 | GSS encryption on (gssEncMode prefer or require); values of 16320 bytes or more | 4.2 |
| CVE-2026-107314 | 42.7.11 through 42.7.13 | requireAuth excludes all six known methods, or is a bare comma | 5.9 |
| CVE-2026-107315 | 42.7.4 through 42.7.13 | Declared length larger than the data supplied | 5.3 |
CVE-2026-107313 is fixed in 42.7.6, and 42.7.14 fixes the others, so 42.7.14 covers all three.
CVE-2026-107315 is the broadest and needs no special connection property. The driver pads a short value with bytes left in its send buffer instead of zeros. NVD says those bytes are earlier messages on the same connection, including SQL text and parameter values, and on a pooled connection they can come from other requests. It happens when an application declares a length larger than the data, through setObject with a ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write or Blob.setBytes. The GitHub advisory says the only workaround is to make the declared length match the data, and that values already stored may contain leaked data.
CVE-2026-107314 only applies if you set requireAuth to an exclusion list such as all six methods negated. The driver then accepts any method the server asks for, including cleartext password. The property has no default, so unset means not affected.
To see your exposure, check the resolved version and grep for the APIs and properties:
mvn dependency:tree -Dincludes=org.postgresql:postgresql
grep -rnE "gssEncMode|requireAuth|ByteStreamWriter|writeToCopy|PGCopyOutputStream|LargeObject|setBytes" --include=*.java --include=*.properties --include=*.yml .
What to do now
- Upgrade org.postgresql:postgresql to 42.7.14, and check the resolved version in the final artifact, since frameworks often bundle their own.
- Use a positive list such as requireAuth=scram-sha-256 instead of exclusions.
- Make declared lengths equal the bytes written, and sample columns written through those calls for stray data.
Quick check
You never set requireAuth or gssEncMode. Which CVE might still apply?
CVE-2026-107315, if any code declares a length larger than the data it writes. It only needs 42.7.4 through 42.7.13.
