{"id":"CVE-2025-49146","aliases":["BIT-postgresql-jdbc-driver-2025-49146","GHSA-hq9p-pm7w-8p54"],"url":"https://o3.security/vulnerability/CVE-2025-49146","summary":"pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration","details":"### Impact\nWhen the PostgreSQL JDBC driver is configured with channel binding set to `required` (default value is `prefer`), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI  authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements.\n\n### Patches\nTBD\n\n### Workarounds\n\nConfigure `sslMode=verify-full` to prevent MITM attacks.\n\n### References\n\n* https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256\n* https://datatracker.ietf.org/doc/html/rfc7677\n* https://datatracker.ietf.org/doc/html/rfc5802","published":"2025-06-11T14:32:39.348Z","modified":"2026-08-12T15:16:35.490107Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"},"epss":{"score":0.00478,"percentile":0.39086,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.postgresql:postgresql","fixedVersion":"42.7.7"}],"fix":{"url":"https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0","label":"pgjdbc/pgjdbc@9217ed1"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49146.json"},{"type":"ADVISORY","url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49146"},{"type":"FIX","url":"https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0"},{"type":"WEB","url":"https://datatracker.ietf.org/doc/html/rfc5802"},{"type":"WEB","url":"https://datatracker.ietf.org/doc/html/rfc7677"},{"type":"PACKAGE","url":"https://github.com/pgjdbc/pgjdbc"},{"type":"WEB","url":"https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T15:16:35.490107Z"}}