What’s Vulnerable › Vulnerabilities

CVE-2022-26520

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-10 · updated 2026-06-17

Description

In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties

Affected products

• Debian Linux: 10.0, 11.0
• Postgresql Jdbc Driver: from 42.1.0 through 42.1.4; from 42.3.0 before 42.3.3 — fixed in 42.3.3

How to fix

Upgrade to a fixed version: Postgresql Jdbc Driver 42.3.3. Check the vendor advisory for mitigations.

References

• https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc
• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8
• https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3
• https://jdbc.postgresql.org/documentation/head/tomcat.html
• https://www.debian.org/security/2022/dsa-5196
• https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc
• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8
• https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3
• https://jdbc.postgresql.org/documentation/head/tomcat.html
• https://www.debian.org/security/2022/dsa-5196

Get alerted when CVE-2022-26520 or the next vulnerability affects your stack