CVE-2025-49146

What it actually does

The JDBC driver bypasses enforced channel binding by permitting authentication methods that lack support for it, allowing unauthenticated MITM interception of sessions configured to require binding.

Why it matters to the business

Organizations relying on the driver for secure PostgreSQL access face elevated risk of credential or data interception on connections they expected to be protected, increasing exposure to data breaches and compliance violations.

How an attack unfolds

An attacker positioned between the application and PostgreSQL server observes connection attempts; when channel binding is set to required, the flawed driver still accepts weaker methods such as password or MD5, enabling the attacker to relay or capture traffic without triggering the expected binding check.

How to fix it

Upgrade pgjdbc to version 42.7.7 or later; for Chainguard packages upgrade go-fips-1.22 and go-fips-1.22-doc to 1.22.11-r0 or newer; verify channel binding remains set to required after the update.

How to confirm the fix worked

Confirm driver version is 42.7.7 or higher; test connections with channel binding required while monitoring for fallback to unsupported authentication methods; review release notes for the channel-binding enforcement fix.

Typical attack path

1. Position as network MITM between JDBC client and PostgreSQL server
2. Observe connection handshake where channel binding is configured as required
3. Relay authentication using an unsupported method accepted by the driver
4. Establish decrypted session to capture queries, results, or credentials

How to detect it

Review application and database connection logs for authentication method entries that show password, MD5, GSS, or SSPI when channel binding should have been enforced; correlate with network flow data indicating unexpected intermediaries.

What your security team should do

• Immediately upgrade all pgjdbc deployments to the fixed versions listed
• Audit JDBC connection strings and configuration for channel-binding=required settings
• Enable TLS certificate validation and logging of authentication method used on all PostgreSQL connections
• Monitor EPSS and threat intelligence for any increase in exploitation activity