{"id":"RHLW-2026-5920e9c5f3ada010","summary":"Lightwell Security Advisory: postgresql 42.7.3.rhlw-00001","details":"Red Hat Lightwell has released org.postgresql:postgresql 42.7.3.rhlw-00001 with a backported security fix.\n\nCVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS\n\nThis patched artifact is a drop-in replacement for org.postgresql:postgresql 42.7.3 from Maven Central.","modified":"2026-10-22T00:08:31.948494490Z","published":"2026-10-08T00:00:00Z","upstream":["CVE-2026-42198","GHSA-98qh-xjc8-98pq"],"references":[{"type":"WEB","url":"https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42198.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19098"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22304"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24348"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:52928"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:52929"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:52930"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:52978"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54532"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59277"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59278"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-42198"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42198.json"},{"type":"ADVISORY","url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42198"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-98qh-xjc8-98pq"}],"affected":[{"package":{"name":"org.postgresql:postgresql","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/org.postgresql/postgresql"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.3.rhlw-00001"}]}],"versions":["42.0.0","42.0.0.jre6","42.0.0.jre7","42.1.0","42.1.0.jre7","42.1.1","42.1.1.jre6","42.1.1.jre7","42.1.2","42.1.2.jre6","42.1.2.jre7","42.1.3","42.1.3.jre6","42.1.3.jre7","42.1.4","42.1.4.jre6","42.1.4.jre7","42.2.0","42.2.0.jre6","42.2.0.jre7","42.2.1","42.2.1.jre6","42.2.1.jre7","42.2.10","42.2.10.jre6","42.2.10.jre7","42.2.11","42.2.11.jre6","42.2.11.jre7","42.2.12","42.2.12.jre6","42.2.12.jre7","42.2.13","42.2.13.jre6","42.2.13.jre7","42.2.14","42.2.14.jre6","42.2.14.jre7","42.2.15","42.2.15.jre6","42.2.15.jre7","42.2.16","42.2.16.jre6","42.2.16.jre7","42.2.17","42.2.17.jre6","42.2.17.jre7","42.2.18","42.2.18.jre6","42.2.18.jre7","42.2.19","42.2.19.jre6","42.2.19.jre7","42.2.2","42.2.2.jre6","42.2.2.jre7","42.2.20","42.2.20.jre6","42.2.20.jre7","42.2.21","42.2.21.jre6","42.2.21.jre7","42.2.22","42.2.22.jre6","42.2.22.jre7","42.2.23","42.2.23.jre6","42.2.23.jre7","42.2.24","42.2.24.jre6","42.2.24.jre7","42.2.25","42.2.25.jre6","42.2.25.jre7","42.2.26","42.2.26.jre6","42.2.26.jre7","42.2.27","42.2.27.jre6","42.2.27.jre7","42.2.28","42.2.28.jre7","42.2.29","42.2.29.jre7","42.2.3","42.2.3.jre6","42.2.3.jre7","42.2.4","42.2.4.jre6","42.2.4.jre7","42.2.5","42.2.5.jre6","42.2.5.jre7","42.2.6","42.2.6.jre6","42.2.6.jre7","42.2.7","42.2.7.jre6","42.2.7.jre7","42.2.8","42.2.8.jre6","42.2.8.jre7","42.2.9","42.2.9.jre6","42.2.9.jre7","42.3.0","42.3.1","42.3.10","42.3.2","42.3.3","42.3.4","42.3.5","42.3.6","42.3.7","42.3.8","42.3.9","42.4.0","42.4.1","42.4.2","42.4.3","42.4.4","42.4.5","42.5.0","42.5.1","42.5.2","42.5.3","42.5.4","42.5.5","42.5.6","42.6.0","42.6.1","42.6.2","42.7.0","42.7.1","42.7.2","42.7.3","9.2-1002-jdbc4","9.2-1003-jdbc3","9.2-1003-jdbc4","9.2-1004-jdbc3","9.2-1004-jdbc4","9.2-1004-jdbc41","9.3-1100-jdbc3","9.3-1100-jdbc4","9.3-1100-jdbc41","9.3-1101-jdbc3","9.3-1101-jdbc4","9.3-1101-jdbc41","9.3-1102-jdbc3","9.3-1102-jdbc4","9.3-1102-jdbc41","9.3-1103-jdbc3","9.3-1103-jdbc4","9.3-1103-jdbc41","9.3-1104-jdbc4","9.3-1104-jdbc41","9.4-1200-jdbc4","9.4-1200-jdbc41","9.4-1201-jdbc4","9.4-1201-jdbc41","9.4-1202-jdbc4","9.4-1202-jdbc41","9.4-1202-jdbc42","9.4-1203-jdbc4","9.4-1203-jdbc41","9.4-1203-jdbc42","9.4-1204-jdbc4","9.4-1204-jdbc41","9.4-1204-jdbc42","9.4-1205-jdbc4","9.4-1205-jdbc41","9.4-1205-jdbc42","9.4-1206-jdbc4","9.4-1206-jdbc41","9.4-1206-jdbc42","9.4.1207","9.4.1207.jre6","9.4.1207.jre7","9.4.1208","9.4.1208.jre6","9.4.1208.jre7","9.4.1209","9.4.1209.jre6","9.4.1209.jre7","9.4.1210","9.4.1210.jre6","9.4.1210.jre7","9.4.1211","9.4.1211.jre6","9.4.1211.jre7","9.4.1212","9.4.1212.jre6","9.4.1212.jre7"],"database_specific":{"lightwell":{"remediated_version":"42.7.3.rhlw-00001","repository_url":"https://packages.redhat.com/lightwell/java/remediated/","backport_base_version":"42.7.3"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-5920e9c5f3ada010.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}