GHSA-98qh-xjc8-98pq — pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

Affected: Maven: org.postgresql:postgresql

## Summary pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication.

### Impact A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools.

In affected versions, `loginTimeout` did not fully mitigate this problem. When `loginTimeout` expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation.

This issue affects availability. It does **not** provide authentication bypass, privilege escalation, or direct password disclosure.

A user is vulnerable when **all** of the following are true:

1. The connection uses **SCRAM-SHA-256** authentication. 2. The client reaches a **malicious, compromised, or attacker-controlled PostgreSQL endpoint**. 3. That endpoint sends a very large SCRAM PBKDF2 iteration count in the `server-first-message`.

In practice, that can happen in these situations:

- the application lets end users or tenants supply their own database connection details (as in many BI, reporting, analytics, ETL, and low-code platforms), so a user can point the shared client host at a server they control - the application accepts connection str…

Most recent entries from all

GHSA-98qh-xjc8-98pq — pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS