CVE-2026-107315

A flaw was found in the PostgreSQL JDBC Driver (pgjdbc). When an application transmits a value shorter than its declared length, the driver pads the remaining data with residual bytes from its internal send buffer instead of zero bytes. An attacker who can induce the application to store and subsequently retrieve such data can access sensitive information, including previously executed database queries and parameters from earlier transactions on pooled connections.

This vulnerability is rated as having a Moderate impact for Red Hat products because exploitation requires specific prerequisites, including custom application logic that misdeclares stream sizes and an attacker who can retrieve the written database records. In deployments utilizing shared connection pools, residual send buffer memory containing earlier database transaction details can be inadvertently committed to storage. Core Red Hat Enterprise Linux releases are unaffected as they include driver versions preceding the introduction of this flaw, limiting exposure primarily to select containerized middleware services.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.