CVE-2026-54291

score

0.1

cvss

5.9

epss

0.2%

published

2026-07-06

kev added

—

first seen

2026-10-21

pgjdbc 42.7.4 through 42.7.11 contains a man-in-the-middle vulnerability caused by silent downgrade of SCRAM-SHA-256-PLUS to SCRAM-SHA-256 due to improper channel binding validation, letting attackers intercept TLS connections, exploit requires attacker to intercept TLS connection with specific certificate.