{"id":"RHLW-2026-b44d1f7dac7a0d3d","summary":"Lightwell Security Advisory: postgresql 42.3.3.rhlw-00006","details":"Red Hat Lightwell has released org.postgresql:postgresql 42.3.3.rhlw-00006 with backported fixes for CVE-2022-31197, CVE-2022-41946, CVE-2024-1597, and CVE-2026-42198.\n\nCVE-2022-31197: SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc\n\nCVE-2022-41946: TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc\n\nCVE-2024-1597: pgjdbc SQL Injection via line comment generation\n\nCVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS\n\nThis patched artifact is a drop-in replacement for org.postgresql:postgresql 42.3.3 from Maven Central.","modified":"2026-10-22T00:08:23.839937558Z","published":"2026-10-08T00:00:00Z","upstream":["CVE-2022-31197","CVE-2022-41946","CVE-2024-1597","CVE-2026-42198","GHSA-24rp-q3w6-vc56","GHSA-562r-vg33-8x8h","GHSA-98qh-xjc8-98pq","GHSA-r38f-c4h4-hqq2"],"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31197.json"},{"type":"ADVISORY","url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31197"},{"type":"FIX","url":"https://github.com/pgjdbc/pgjdbc/commit/739e599d52ad80f8dcd6efedc6157859b1a9d637"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-r38f-c4h4-hqq2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41946.json"},{"type":"ADVISORY","url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-562r-vg33-8x8h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41946"},{"type":"FIX","url":"https://github.com/pgjdbc/pgjdbc/commit/9008dc9aade6dbfe4efafcd6872ebc55f4699cf5"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-562r-vg33-8x8h"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1597.json"},{"type":"ADVISORY","url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1597"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-24rp-q3w6-vc56"},{"type":"WEB","url":"https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42198.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19098"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22304"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24348"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:52928"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:52929"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:52930"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:52978"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54532"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59277"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59278"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-42198"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42198.json"},{"type":"ADVISORY","url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42198"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-98qh-xjc8-98pq"}],"affected":[{"package":{"name":"org.postgresql:postgresql","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/org.postgresql/postgresql"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3.3.rhlw-00006"}]}],"versions":["42.0.0","42.0.0.jre6","42.0.0.jre7","42.1.0","42.1.0.jre7","42.1.1","42.1.1.jre6","42.1.1.jre7","42.1.2","42.1.2.jre6","42.1.2.jre7","42.1.3","42.1.3.jre6","42.1.3.jre7","42.1.4","42.1.4.jre6","42.1.4.jre7","42.2.0","42.2.0.jre6","42.2.0.jre7","42.2.1","42.2.1.jre6","42.2.1.jre7","42.2.10","42.2.10.jre6","42.2.10.jre7","42.2.11","42.2.11.jre6","42.2.11.jre7","42.2.12","42.2.12.jre6","42.2.12.jre7","42.2.13","42.2.13.jre6","42.2.13.jre7","42.2.14","42.2.14.jre6","42.2.14.jre7","42.2.15","42.2.15.jre6","42.2.15.jre7","42.2.16","42.2.16.jre6","42.2.16.jre7","42.2.17","42.2.17.jre6","42.2.17.jre7","42.2.18","42.2.18.jre6","42.2.18.jre7","42.2.19","42.2.19.jre6","42.2.19.jre7","42.2.2","42.2.2.jre6","42.2.2.jre7","42.2.20","42.2.20.jre6","42.2.20.jre7","42.2.21","42.2.21.jre6","42.2.21.jre7","42.2.22","42.2.22.jre6","42.2.22.jre7","42.2.23","42.2.23.jre6","42.2.23.jre7","42.2.24","42.2.24.jre6","42.2.24.jre7","42.2.25","42.2.25.jre6","42.2.25.jre7","42.2.26","42.2.26.jre6","42.2.26.jre7","42.2.27","42.2.27.jre6","42.2.27.jre7","42.2.28","42.2.28.jre7","42.2.29","42.2.29.jre7","42.2.3","42.2.3.jre6","42.2.3.jre7","42.2.4","42.2.4.jre6","42.2.4.jre7","42.2.5","42.2.5.jre6","42.2.5.jre7","42.2.6","42.2.6.jre6","42.2.6.jre7","42.2.7","42.2.7.jre6","42.2.7.jre7","42.2.8","42.2.8.jre6","42.2.8.jre7","42.2.9","42.2.9.jre6","42.2.9.jre7","42.3.0","42.3.1","42.3.2","42.3.3","9.2-1002-jdbc4","9.2-1003-jdbc3","9.2-1003-jdbc4","9.2-1004-jdbc3","9.2-1004-jdbc4","9.2-1004-jdbc41","9.3-1100-jdbc3","9.3-1100-jdbc4","9.3-1100-jdbc41","9.3-1101-jdbc3","9.3-1101-jdbc4","9.3-1101-jdbc41","9.3-1102-jdbc3","9.3-1102-jdbc4","9.3-1102-jdbc41","9.3-1103-jdbc3","9.3-1103-jdbc4","9.3-1103-jdbc41","9.3-1104-jdbc4","9.3-1104-jdbc41","9.4-1200-jdbc4","9.4-1200-jdbc41","9.4-1201-jdbc4","9.4-1201-jdbc41","9.4-1202-jdbc4","9.4-1202-jdbc41","9.4-1202-jdbc42","9.4-1203-jdbc4","9.4-1203-jdbc41","9.4-1203-jdbc42","9.4-1204-jdbc4","9.4-1204-jdbc41","9.4-1204-jdbc42","9.4-1205-jdbc4","9.4-1205-jdbc41","9.4-1205-jdbc42","9.4-1206-jdbc4","9.4-1206-jdbc41","9.4-1206-jdbc42","9.4.1207","9.4.1207.jre6","9.4.1207.jre7","9.4.1208","9.4.1208.jre6","9.4.1208.jre7","9.4.1209","9.4.1209.jre6","9.4.1209.jre7","9.4.1210","9.4.1210.jre6","9.4.1210.jre7","9.4.1211","9.4.1211.jre6","9.4.1211.jre7","9.4.1212","9.4.1212.jre6","9.4.1212.jre7"],"database_specific":{"lightwell":{"repository_url":"https://packages.redhat.com/lightwell/java/remediated/","backport_base_version":"42.3.3","remediated_version":"42.3.3.rhlw-00006"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-b44d1f7dac7a0d3d.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}