StackRadar

CVE-2026-42198

High

Advisory

Published 1 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.033
88th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
266
of 17,781 indexed, latest versions
Container images
209
deployed by those charts
Fix available
3 of 3
affected packages

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

Carried by container images the latest versions of 266 of 17,781 indexed charts deploy, on 209 images.

Affected packageAffected versionsFixed inImages
postgresqlmaven42.2.1, 42.2.2, 42.2.2.jre7, 42.2.5+43 more42.7.11209
postgresql-jdbc-driverbitnami42.7.7, 42.7.842.7.112
PostgreSQL JDBC Driverbitnami42.6.0, 42.7.342.7.112
OSV records
BIT-postgresql-jdbc-driver-2026-42198GHSA-98qh-xjc8-98pq

Charts affected

266 by stars
ChartLatestAffected imagesRadar Score
shenyutest-helm2.4.211 of 2See more

shenyu test-helm 2.4.21

1 of the 2 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
postgresql@42.2.8
42.7.11

Open the chart page →

12,513
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
thingsboard/tb-node:3.4.1645f43b688f7
postgresql@42.2.20
42.7.11

Open the chart page →

25,394
pagesthiru-pages1.0.01 of 3See more

pages thiru-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
flyway/flyway:6.4.422d97ceb0c47
postgresql@42.2.12.jre6
42.7.11

Open the chart page →

20,190
pagesthuy-pages1.0.01 of 3See more

pages thuy-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
flyway/flyway:6.4.422d97ceb0c47
postgresql@42.2.12.jre6
42.7.11

Open the chart page →

20,190
togglr-backendtogglrVerified publisher1.0.01 of 1See more

togglr-backend togglr 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
gdrocha/togglr-backend:1.0.0d5ae64e83d4c
postgresql@42.7.3
42.7.11

Open the chart page →

3,221
timetabletwomartensVerified publisher0.2.01 of 1See more

timetable twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
2martens/timetable:latestbd1ba6ab84c9
postgresql@42.7.7
42.7.11

Open the chart page →

1,527
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.1.4044a457e0498
postgresql@42.7.4
42.7.11

Open the chart page →

45,239
pagesvictor-pages1.0.01 of 3See more

pages victor-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
flyway/flyway:6.4.422d97ceb0c47
postgresql@42.2.12.jre6
42.7.11

Open the chart page →

20,190
pageswalter1.0.01 of 3See more

pages walter 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
flyway/flyway:6.4.422d97ceb0c47
postgresql@42.2.12.jre6
42.7.11

Open the chart page →

20,190
sonarqubewebencryptor6.7.31 of 3See more

sonarqube webencryptor 6.7.3

1 of the 3 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
library/sonarqube:8.2-communitya246bc64207e
postgresql@42.2.8
42.7.11

Open the chart page →

5,460
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
postgresql@42.2.5
42.7.11

Open the chart page →

28,605
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
postgresql@42.7.8
postgresql-jdbc-driver@42.7.8
42.7.11
42.7.11

Open the chart page →

7,624
apicurio-registry-sqlwitcom-gmbh0.1.01 of 1See more

apicurio-registry-sql witcom-gmbh 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
apicurio/apicurio-registry-jpa:1.3.2.Final44eeddd3562c
postgresql@42.2.16
42.7.11

Open the chart page →

3,424
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
postgresql@42.6.0
42.7.11

Open the chart page →

11,577
zahori-serverzahoriVerified publisher1.0.12 of 2See more

zahori-server zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
flyway/flyway:9.14.1-alpine80f12c80502b
postgresql@42.4.3
42.7.11
zahoriaut/zahori-server:0.1.17b2de13916f3e
postgresql@42.3.8
42.7.11

Open the chart page →

5,846
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-42198.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
postgresql@42.5.1
42.7.11

Open the chart page →

6,016

Container images carrying it

209 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
flyway/flyway:6.4.422d97ceb0c47
postgresql@42.2.12.jre6
42.7.11
79
apache/shenyu-admin:2.4.2e8b7c4ddd069
postgresql@42.2.8
42.7.11
3
supertokens/supertokens-postgresql:3.1418d34c781347
postgresql@42.2.10
42.7.11
3
airbyte/workload-launcher:2.2.0119be7bfb719
postgresql@42.7.8
42.7.11
2
apache/druid:37.0.00116fb802786
postgresql@42.7.2
42.7.11
2
apache/fineract:1.12.1a83cf1980609
postgresql@42.7.4
42.7.11
2
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
postgresql@42.2.5
42.7.11
2
dependencytrack/apiserver:4.6.3485ac0952c02
postgresql@42.5.0
42.7.11
2
dina1993/airports-api:latestac731244aed1
postgresql@42.5.4
42.7.11
2
dina1993/airports-consumer:latest669d146a5e63
postgresql@42.5.4
42.7.11
2
dina1993/airports-producer:latest3d6b0dac1cb4
postgresql@42.5.4
42.7.11
2
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
postgresql@42.2.14
42.7.11
2
geoservercloud/geoserver-cloud-wcs:1.0-RC35c254c53a357
postgresql@42.2.14
42.7.11
2
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
postgresql@42.2.14
42.7.11
2
geoservercloud/geoserver-cloud-wfs:1.0-RC35288f320cf36
postgresql@42.2.14
42.7.11
2
geoservercloud/geoserver-cloud-wms:1.0-RC3a30a60ac6cd0
postgresql@42.2.14
42.7.11
2
scorpiobroker/scorpio:RegistrySubscriptionManager_2.1.001e11d800459
postgresql@42.3.1
42.7.11
2
scorpiobroker/scorpio:AtContextServer_2.1.05073ceef2fa0
postgresql@42.3.1
42.7.11
2
scorpiobroker/scorpio:RegistryManager_2.1.0a2cfcf0947fd
postgresql@42.3.1
42.7.11
2
scorpiobroker/scorpio:QueryManager_2.1.0b742a53b2803
postgresql@42.3.1
42.7.11
2
scorpiobroker/scorpio:HistoryManager_2.1.0b7fe27a06ff5
postgresql@42.3.1
42.7.11
2
scorpiobroker/scorpio:SubscriptionManager_2.1.0e08036670d66
postgresql@42.3.1
42.7.11
2
scorpiobroker/scorpio:EntityManager_2.1.0f02e8a429a08
postgresql@42.3.1
42.7.11
2
ghcr.io/appscode/inbox-server:latest:postgres-latest536358d7b17e
postgresql@42.7.5
42.7.11
2
ghcr.io/janssenproject/jans/auth-server:0.0.0-nightly7752874e71d8
postgresql@42.7.8
42.7.11
2
ghcr.io/janssenproject/jans/casa:0.0.0-nightly3f2d14563495
postgresql@42.7.8
42.7.11
2
ghcr.io/janssenproject/jans/config-api:0.0.0-nightly900e2b88bd08
postgresql@42.7.8
42.7.11
2
ghcr.io/janssenproject/jans/fido2:0.0.0-nightly2a797804f08c
postgresql@42.7.8
42.7.11
2
ghcr.io/janssenproject/jans/scim:0.0.0-nightly096b8bcbbe45
postgresql@42.7.8
42.7.11
2
quay.io/keycloak/keycloak:26.1.4044a457e0498
postgresql@42.7.4
42.7.11
2
quay.io/keycloak/keycloak:20.0054ef67eb7da
postgresql@42.5.1
42.7.11
2
quay.io/keycloak/keycloak:17.0.1-legacy68f9f38c8f30
postgresql@42.2.5
42.7.11
2
1dev/server:11.9.0cd5b12fe5471
postgresql@42.7.3
42.7.11
1
2martens/timetable:latestbd1ba6ab84c9
postgresql@42.7.7
42.7.11
1
ahmetfurkandemir/iceberg-rest-fixture-postgresql:1.10.0142231a0b8b7
postgresql@42.7.5
42.7.11
1
airbyte/bootloader:2.2.0f71cf4e185d5
postgresql@42.7.8
42.7.11
1
airbyte/connector-rollout-worker:2.0.2-alpha-c905e75d42813fcc191
postgresql@42.7.7
42.7.11
1
airbyte/cron:0.40.17caf4f551c546
postgresql@42.5.0
42.7.11
1
airbyte/cron:2.2.0d97b67a1346d
postgresql@42.7.8
42.7.11
1
airbyte/server:2.2.070e125498a1c
postgresql@42.7.8
42.7.11
1
airbyte/worker:2.2.08060b88b29c8
postgresql@42.7.8
42.7.11
1
airbyte/workload-api-server:2.2.042093cff86e9
postgresql@42.7.8
42.7.11
1
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
postgresql@42.2.20
42.7.11
1
alfio/alf.io:2.0-M5-26060c836a081446
postgresql@42.7.10
42.7.11
1
apache/druid:29.0.10cef139b6bf1
postgresql@42.7.2
42.7.11
1
apache/hertzbeat:1.8.075d48a62748f
postgresql@42.5.5
42.7.11
1
apache/hertzbeat-collector:1.8.0a2bab1be574c
postgresql@42.5.5
42.7.11
1
apache/ranger:2.7.076c176e8a0e4
postgresql@42.2.16.jre7
42.7.11
1
apache/shenyu-admin:2.5.1e2be712fc4f4
postgresql@42.3.5
42.7.11
1
apache/skywalking-oap-server:9.2.0133d35d2c263
postgresql@42.3.3
42.7.11
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.