Overview
This advisory addresses a known security vulnerability identified in a third-party dependency used within DPGW.
Vulnerability Details
- CVE ID: CVE-2026-54291
- Dependency Name: org.postgresql:postgresql (PostgreSQL JDBC Driver, pgjdbc)
- Affected Version of Dependency: 42.7.4 – 42.7.11 (fixed in 42.7.12)
- Severity Score: NIST 5.9 Medium
(CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N); CNA (GitHub) 8.2 High (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N)
Affected Versions of DPGW
- <= 1.14.08-REL (bundles pgjdbc 42.7.11)
- <= 1.13.29-REL (bundles pgjdbc 42.7.11)
- <= 1.12.51-REL (bundles pgjdbc 42.7.11)
The 1.11 branch (currently 1.11.47-REL) ships pgjdbc 42.7.3, which predates the vulnerable code and is not within the affected range.
Risk Assessment & Applicability
Usage
DPGW uses the PostgreSQL JDBC driver (pgjdbc) as the client driver for its application database. The database connection is configured in the <database> section of dpgw.xml via the connection-url parameter; the default and documented value is jdbc:postgresql://localhost/.... DPGW does not set the channelBinding connection property, nor does it enable TLS on the database connection (sslmode / ssl are not configured in any shipped or example configuration).
Analysis
CVE-2026-0636
CVE-2026-54291 is a silent channel-binding authentication downgrade in pgjdbc. When a client requests channelBinding=require over a TLS connection, the SCRAM client returns empty byte arrays instead of failing when it encounters a TLS certificate signed with an unsupported signature algorithm. This lets an active man-in-the-middle on the TCP/TLS path between the JDBC client and the PostgreSQL server downgrade SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it), defeating the MITM protection that channel binding is meant to guarantee. Exploitation requires an attacker positioned on the network path between the application and its database.
In the deployment configuration covered by this advisory — the PostgreSQL database residing on the same host as DPGW and accepting only localhost connections — the DPGW-to-database traffic never leaves the host. There is no network segment for an attacker to occupy, so the man-in-the-middle precondition of the vulnerability cannot be met. This matches DPGW’s default and documented configuration (jdbc:postgresql://localhost/...). In addition, DPGW does not request channel binding and does not use TLS for the database connection, so the vulnerable negotiation path is not exercised in the first place.
Status
Not affected
Impact on DPGW
No impact for deployments where the PostgreSQL database is co-located on the DPGW host and reachable only via localhost. With no network path between DPGW and the database, the man-in-the-middle prerequisite of CVE-2026-54291 cannot be satisfied.
Note: Deployments that connect DPGW to a PostgreSQL instance over a network (for example a database on a separate host, as used in some multi-site/replication setups) and that rely on channelBinding=require for MITM protection should treat the driver as vulnerable and apply the fix below. Standard DPGW deployments do not use this configuration.
Remediation & Mitigations
Scheduled fix
The driver has been updated to a fixed version on the development line:
– main (next release line) — pgjdbc bumped to 42.7.13 (commit chore(Security): bump postgres due to CVE-2026-54291)
Since DPGW is Not Affected in the standard localhost database configuration, the pgjdbc 42.7.12+ bump will roll into the maintained 1.12 / 1.13 / 1.14 branches as part of routine dependency maintenance rather than as an emergency release. The 1.11 branch is unaffected at the dependency level (pgjdbc 42.7.3) and needs no change.
User Actions
No user action required for the standard configuration (database on the same host, localhost-only connections).
Operators can confirm they are in the unaffected configuration by checking that the connection-url in the <database> section of dpgw.xml points to localhost (or 127.0.0.1) and that PostgreSQL is configured to accept only local connections. Operators running DPGW against a remote PostgreSQL database over an untrusted network should upgrade to a DPGW build bundling pgjdbc 42.7.12 or later.