WaratekVRT Sign in

CVE-2024-1597 PostgreSQL JDBC Driver

Affected softwarePostgreSQL JDBC Driver
Severity10.0 Critical CVSS 3.1 2 scores
Fixed in42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
WeaknessSQL injection (CWE-89)
Published19 Feb 2024
Updated4 Nov 2026

Description

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · earliest 2024-10-30.
  • CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: yes, technical impact: total.
  • Indexed PoC none indexed
  • EPSS 4.8% chance in 30 days

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2024-1597 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation reliaquest.com /blog/5-critical-threat-actors-you-need-to-know-about 2024-10-30

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action feasible
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to Mitigation candidate.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

SQL injection in the PostgreSQL JDBC driver (pgjdbc) when the non-default preferQueryMode=simple connection property is set. The SQL rule does not currently protect against this CVE.

CVSS

10.0 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H PostgreSQL Secondary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2024 ↗ CPU 2024-Q2 Oracle Fusion Middleware / Third Party (PostgreSQL JDBC Driver) (12.2.1.4.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Third Party (PostgreSQL JDBC Driver) 12.2.1.4.0 12.2.1.4.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.postgresql:postgresql 0 42.2.28 unbounded
org.postgresql:postgresql 42.3.0 42.3.9 unbounded
org.postgresql:postgresql 42.4.0 42.4.4 unbounded
org.postgresql:postgresql 42.5.0 42.5.5 unbounded
org.postgresql:postgresql 42.6.0 42.6.1 unbounded
org.postgresql:postgresql 42.7.0 42.7.2 unbounded

Products and versions

3 products, 13 version entries
SourceVendorProductSchemeAffected versions
nvd fedoraproject fedora generic 40
osv org.postgresql postgresql generic ＜ 42.2.28 · ≥ 42.3.0 and ＜ 42.3.9 · ≥ 42.4.0 and ＜ 42.4.4 · ≥ 42.5.0 and ＜ 42.5.5 · ≥ 42.6.0 and ＜ 42.6.1 · ≥ 42.7.0 and ＜ 42.7.2
nvd postgresql postgresql jdbc driver generic ＜ 42.2.28 · ≥ 42.3.0 and ＜ 42.3.9 · ≥ 42.4.0 and ＜ 42.4.4 · ≥ 42.5.0 and ＜ 42.5.5 · ≥ 42.6.0 and ＜ 42.6.1 · ≥ 42.7.0 and ＜ 42.7.2

References

URLTags
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56 WEB
https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee WEB
https://github.com/pgjdbc/pgjdbc/commit/93b0fcb2711d9c1e3a2a03134369738a02a58b40 WEB
https://github.com/pgjdbc/pgjdbc PACKAGE
http://www.openwall.com/lists/oss-security/2024/04/02/6
https://lists.debian.org/debian-lts-announce/2024/05/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TZQTSMESZD2RJ5XBPSXH3TIQVUW5DIUU/ Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20240419-0008/
https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/ Release Notes
https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/ Third Party Advisory

Timeline
Published2024-02-19By the CVE Program.
VulnCheck KEV: earliest evidence2024-10-30Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Last VRT activity2026-11-04Most recent commit touching this CVE's classification, patch or rule file.
Classification created2026-11-13First commit adding this CVE's research note.