{"cve":"CVE-2025-49146","nvd":{"published":"2025-06-11T15:15:42.850","modified":"2026-06-17T09:30:49.570","status":"Analyzed","description":"pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9},"cwes":["CWE-287"],"references":["https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0","https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54"],"products":["postgresql:postgresql_jdbc_driver"],"source":"nvd","synced_at":"2026-10-19T22:02:23.998251710+00:00"},"epss":{"cve":"CVE-2025-49146","score":0.00486,"percentile":0.41864,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hq9p-pm7w-8p54","url":"https://osv.dev/vulnerability/GHSA-hq9p-pm7w-8p54","summary":"pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration","modified":"2026-09-10T03:50:25.410496896Z","packages":[{"ecosystem":"Maven","name":"org.postgresql:postgresql","purl":"pkg:maven/org.postgresql/postgresql","ranges":[">=42.7.4 <42.7.7"],"fixed":["42.7.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}