The PostgreSQL JDBC team has shipped 42.7.14, a dedicated security release that fixes two distinct vulnerabilities in the Java database driver. Because this is a patch-level security update rather than a feature release, the maintainers are directing users to upgrade promptly instead of waiting for the next scheduled minor version.
- The release addresses CVE-2026-107314, which is also tracked under the GitHub Security Advisory
GHSA-rhp9-mr79-r74h. - A second issue, CVE-2026-107315, is covered by the advisory
GHSA-f64h-wr5q-3qf3. - Both are bundled into a single patch release: PostgreSQL JDBC 42.7.14.
- The announcement states that the full technical details are in the release notes, and points at the two advisories for per-issue information.
Two CVEs landing in the same patch means anyone on the 42.7.x line should treat 42.7.14 as the new minimum safe version. The official artefacts are published under the usual org.postgresql coordinates, so a Maven or Gradle bump is typically a one-line change:
<version>42.7.14</version>
For teams that cannot upgrade immediately, the advisories are the place to check whether the specific issue is reachable in your deployment — the source material does not break down the impact or attack vector of either CVE, so the advisory pages and release notes remain the authoritative references.
Why this matters to developers: the JDBC driver sits directly between application code and the PostgreSQL server, so a flaw in it is not something that can be mitigated purely at the database or network layer. Because the announcement covers the affected fixes only and gives no scope beyond the version number, the safe default is to pin the driver to 42.7.14, re-run integration tests, and confirm the resolved dependency tree in your build output. Tracking the two GHSA identifiers in your dependency scanner will flag any transitive copies of the driver that lag behind. Verify the upgrade actually took effect before closing the ticket — older driver versions are frequently pulled in indirectly by connection pools, ORM frameworks, or cached build artefacts.