PostgreSQL JDBC fixes authentication restrictions and residual data: update Java application drivers too
The PostgreSQL JDBC team announces security update 42.7.14, addressing ineffective authentication-method restrictions and data from earlier queries potentially being included in written values. Alongside database updates, check connection drivers bundled with Java applications.
Source Facts
On 9 October, the JDBC Project published news of version 42.7.14, stating that it was released on 7 October and addresses CVE-2026-107314 and CVE-2026-107315. Both affect the PostgreSQL Java driver. Checking the database server version alone cannot establish that remediation is complete.
The linked release notes say some older versions treated a requireAuth setting that excluded all authentication methods as though it were unset. Another issue could allow padding in written values to contain earlier messages from the same connection. Fixed versions reject invalid authentication settings and zero-fill incomplete data.
Include JDBC packages in application dependency inventories. After upgrading, verify connection policies and data-writing behaviour. A driver patch does not mean the database server has been updated.
Original sources
2026-10-07: PostgreSQL JDBC 42.7.14 Security update for multiple CVE's
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationAmazon Linux updates its Docker security advisory: check container hosts and archive handling
IllustrationEmergency .NET update supplies a previously omitted fix: check Windows application versions again
Illustration