org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade (CVE…

Overview

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A remote attacker who can intercept a TLS (Transport Layer Security) connection can silently downgrade connections configured to require channel binding from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This downgrade bypasses the intended man-in-the-middle protection, allowing the attacker to potentially intercept or alter sensitive communication. The vulnerability occurs because the system fails to properly validate the channel binding when a specific type of certificate is used.

Vendor advisories

• RHSA-2026:53643 · Red Hat · fixed in: Red Hat build of Quarkus 3.27.5 · released 2026-08-13 · advisory
• RHSA-2026:51653 · Red Hat · fixed in: Red Hat build of Quarkus 3.33.3 · released 2026-08-13 · advisory
• Red Hat VEX · Moderate · affected: Cryostat 4, Red Hat AMQ Broker 7, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Build of Keycloak, Red Hat Data Grid 8, … · no fix planned: Cryostat 4, Red Hat AMQ Broker 7, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, … · updated 2026-10-20 · vex

org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade — rated Moderate by Red Hat. Released 2026-07-06, updated 2026-10-20.

Affected:

• Cryostat 4
• Red Hat AMQ Broker 7
• Red Hat build of Apicurio Registry 3
• Red Hat build of Debezium 3
• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• Red Hat Single Sign-On 7

Fixed:

• Red Hat build of Quarkus 3.27.5
• Red Hat build of Quarkus 3.33.3

No fix planned:

• Cryostat 4
• Red Hat AMQ Broker 7
• Red Hat build of Apicurio Registry 3
• Red Hat build of Debezium 3
• Red Hat Data Grid 8
• Red Hat Single Sign-On 7
• Red Hat Build of Keycloak

Not affected:

• Red Hat Hardened Images

Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For information about how to apply this update, see https://access.redhat.com/articles/11258. https://access.redhat.com/errata/RHSA-2026:53643 Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:51653

Package advisory (CVE-2026-54291)

Affected packages:

• org.postgresql:postgresql >= 42.7.4, < 42.7.12

Patched in:

• org.postgresql:postgresql 42.7.12

Source: https://github.com/advisories/GHSA-j92g-9f8w-j867