CVE-2026-42198
HighAdvisory
Published 1 May 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.033
- 88th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 266
- of 17,781 indexed, latest versions
- Container images
- 209
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS
Carried by container images the latest versions of 266 of 17,781 indexed charts deploy, on 209 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| postgresqlmaven | 42.2.1, 42.2.2, 42.2.2.jre7, 42.2.5+43 more | 42.7.11 | 209 |
| postgresql-jdbc-driverbitnami | 42.7.7, 42.7.8 | 42.7.11 | 2 |
| PostgreSQL JDBC Driverbitnami | 42.6.0, 42.7.3 | 42.7.11 | 2 |
Charts affected
266 by stars
Container images carrying it
209 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| flyway/ | 22d97ceb0c47 | postgresql | 42.7.11 | 79 |
| apache/ | e8b7c4ddd069 | postgresql | 42.7.11 | 3 |
| supertokens/ | 18d34c781347 | postgresql | 42.7.11 | 3 |
| airbyte/ | 119be7bfb719 | postgresql | 42.7.11 | 2 |
| apache/ | 0116fb802786 | postgresql | 42.7.11 | 2 |
| apache/ | a83cf1980609 | postgresql | 42.7.11 | 2 |
| apachepulsar/ | b341ef76a852 | postgresql | 42.7.11 | 2 |
| dependencytrack/ | 485ac0952c02 | postgresql | 42.7.11 | 2 |
| dina1993/ | ac731244aed1 | postgresql | 42.7.11 | 2 |
| dina1993/ | 669d146a5e63 | postgresql | 42.7.11 | 2 |
| dina1993/ | 3d6b0dac1cb4 | postgresql | 42.7.11 | 2 |
| geoservercloud/ | 99540eef78ad | postgresql | 42.7.11 | 2 |
| geoservercloud/ | 5c254c53a357 | postgresql | 42.7.11 | 2 |
| geoservercloud/ | c687b1cbc891 | postgresql | 42.7.11 | 2 |
| geoservercloud/ | 5288f320cf36 | postgresql | 42.7.11 | 2 |
| geoservercloud/ | a30a60ac6cd0 | postgresql | 42.7.11 | 2 |
| scorpiobroker/ | 01e11d800459 | postgresql | 42.7.11 | 2 |
| scorpiobroker/ | 5073ceef2fa0 | postgresql | 42.7.11 | 2 |
| scorpiobroker/ | a2cfcf0947fd | postgresql | 42.7.11 | 2 |
| scorpiobroker/ | b742a53b2803 | postgresql | 42.7.11 | 2 |
| scorpiobroker/ | b7fe27a06ff5 | postgresql | 42.7.11 | 2 |
| scorpiobroker/ | e08036670d66 | postgresql | 42.7.11 | 2 |
| scorpiobroker/ | f02e8a429a08 | postgresql | 42.7.11 | 2 |
| ghcr.io/ | 536358d7b17e | postgresql | 42.7.11 | 2 |
| ghcr.io/ | 7752874e71d8 | postgresql | 42.7.11 | 2 |
| ghcr.io/ | 3f2d14563495 | postgresql | 42.7.11 | 2 |
| ghcr.io/ | 900e2b88bd08 | postgresql | 42.7.11 | 2 |
| ghcr.io/ | 2a797804f08c | postgresql | 42.7.11 | 2 |
| ghcr.io/ | 096b8bcbbe45 | postgresql | 42.7.11 | 2 |
| quay.io/ | 044a457e0498 | postgresql | 42.7.11 | 2 |
| quay.io/ | 054ef67eb7da | postgresql | 42.7.11 | 2 |
| quay.io/ | 68f9f38c8f30 | postgresql | 42.7.11 | 2 |
| 1dev/ | cd5b12fe5471 | postgresql | 42.7.11 | 1 |
| 2martens/ | bd1ba6ab84c9 | postgresql | 42.7.11 | 1 |
| ahmetfurkandemir/ | 142231a0b8b7 | postgresql | 42.7.11 | 1 |
| airbyte/ | f71cf4e185d5 | postgresql | 42.7.11 | 1 |
| airbyte/ | d42813fcc191 | postgresql | 42.7.11 | 1 |
| airbyte/ | caf4f551c546 | postgresql | 42.7.11 | 1 |
| airbyte/ | d97b67a1346d | postgresql | 42.7.11 | 1 |
| airbyte/ | 70e125498a1c | postgresql | 42.7.11 | 1 |
| airbyte/ | 8060b88b29c8 | postgresql | 42.7.11 | 1 |
| airbyte/ | 42093cff86e9 | postgresql | 42.7.11 | 1 |
| airsonicadvanced/ | f7cbafac2806 | postgresql | 42.7.11 | 1 |
| alfio/ | 0c836a081446 | postgresql | 42.7.11 | 1 |
| apache/ | 0cef139b6bf1 | postgresql | 42.7.11 | 1 |
| apache/ | 75d48a62748f | postgresql | 42.7.11 | 1 |
| apache/ | a2bab1be574c | postgresql | 42.7.11 | 1 |
| apache/ | 76c176e8a0e4 | postgresql | 42.7.11 | 1 |
| apache/ | e2be712fc4f4 | postgresql | 42.7.11 | 1 |
| apache/ | 133d35d2c263 | postgresql | 42.7.11 | 1 |