PostgreSQL JDBC 42.7.12 Security Release Fixes Silent Channel-Binding Downgrade (CVE-2026-54291)

A security vulnerability (CVE-2026-54291) has been discovered in the PostgreSQL JDBC driver affecting versions 42.7.4 through 42.7.11. The bug allows a silent downgrade of channelBinding=require connections from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without channel binding), defeating the man-in-the-middle protection that the setting is designed to guarantee.

The vulnerability arises from a combination of two issues:

The bundled com.ongres.scram:scram-client library (versions 3.1 and 3.2) returns an empty byte array instead of failing when it cannot derive the tls-server-end-point channel-binding hash for certificates using algorithms like Ed25519, Ed448, or post-quantum algorithms. This is tracked as GHSA-p9jg-fcr6-3mhf.
The ScramAuthenticator in pgJDBC only checks that the server advertised a -PLUS mechanism; it does not reject an empty binding value or verify that the negotiated mechanism actually uses channel binding when channelBinding=require is set.

Concrete changes in 42.7.12:

Fixes the silent downgrade by ensuring that when channelBinding=require is set, the connection fails if the server does not support channel binding or if the binding cannot be derived.
Updates the bundled scram-client library to a version that properly throws an error instead of returning an empty byte array for unsupported certificate signature algorithms.
Only connections explicitly setting channelBinding=require are affected; connections using the default prefer policy, allow, or disable are not vulnerable.

Why this matters to developers:

If you use PostgreSQL JDBC with channelBinding=require to protect against active MITM attacks, all connections up to 42.7.11 were silently downgraded, giving a false sense of security. Attackers who can intercept TLS traffic could exploit this to downgrade authentication and potentially capture credentials or tamper with data. Immediately upgrade to version 42.7.12 on all production and development systems.

Source: https://www.postgresql.org/about/news/postgresql-jdbc-42712-security-release-3340/