# PostgreSQL JDBC Patches Two Vulnerabilities

Published: 2026-10-12 · Severity: routine
Canonical: https://vorant.io/reports/93cc4f60-65c8-55ce-86ac-a138c4e7b6fc/postgresql-jdbc-patches-two-vulnerabilities

> CERT-FR advisory warns of two vulnerabilities in PostgreSQL JDBC driver before 42.7.14 risking data confidentiality and security bypass.

CERT-FR has published an advisory covering two vulnerabilities (CVE-2026-107314 and CVE-2026-107315) affecting the PostgreSQL JDBC driver (pgjdbc) in versions prior to 42.7.14. The vulnerabilities could allow an attacker to compromise data confidentiality and bypass security policy enforcement, though the advisory does not detail the specific exploitation mechanics or confirm active exploitation in the wild.

Defenders using applications that rely on the PostgreSQL JDBC driver should identify affected deployments and upgrade to version 42.7.14 or later as referenced in the vendor security bulletins (GitHub security advisories GHSA-f64h-wr5q-3qf3 and GHSA-rhp9-mr79-r74h, and the official PostgreSQL JDBC announcement). No indicators of compromise or detection guidance were provided, as this is a vulnerability disclosure with patch guidance rather than an active exploitation report.

## Mentioned in this report

- Vulnerabilities: CVE-2026-107314, CVE-2026-107315

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1292

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/93cc4f60-65c8-55ce-86ac-a138c4e7b6fc/postgresql-jdbc-patches-two-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup