PostgreSQL’s Java driver fixes authentication filtering and stale-byte leaks

PostgreSQL JDBC 42.7.14 fixes two security problems. Certain requireAuth configurations previously allowed authentication methods that the configuration meant to reject. Separately, when an application supplied fewer bytes than it declared, the driver could fill the gap with bytes from earlier messages on the same connection, potentially storing previous SQL or parameter data.

PostgreSQL JDBC Project · Oct 7, 2026

Why it matters

Java applications should check their actual driver version and configuration rather than assuming a PostgreSQL server upgrade includes these fixes.

More context

Upgrade and test connection policies and custom stream writers. Authentication filtering affects 42.7.11–42.7.13; the short-value issue affects 42.7.4–42.7.13. The fixed driver rejects the problematic authentication settings and uses zero padding for short values. Prefer a positive list of required authentication methods.

Keep in mind

The authentication issue depends on specific configuration values, and the data leak depends on a supplied length mismatch. Existing misconfigured connections may fail after upgrading. These are maintainer advisories; we have not reproduced the vulnerabilities.

Original read