A vulnerability in the PostgreSQL JDBC driver allows a malicious server to trigger a denial of service by exhausting client CPU resources through unbounded PBKDF2 computations.

This is a resource allocation flaw (CWE-770) where the driver fails to limit CPU usage during SCRAM-SHA-256 authentication. An unauthenticated attacker acting as a malicious database server can force the client to perform excessive PBKDF2 iterations, which persists even after a connection timeout occurs.

This vulnerability poses a significant risk to application availability, as a single malicious server can exhaust client CPU cores and saturate application connection pools. With a CVSS score of 7.5, the high severity reflects the ease of exploitation and the potential for complete service disruption for any application relying on the affected JDBC driver. Prolonged downtime could lead to significant operational disruption and loss of business continuity.

Immediate Action: Update the PostgreSQL JDBC driver to version 42.7.11 or later to implement the necessary resource constraints.

Proactive Monitoring: Monitor application server CPU utilization and connection pool health for unexpected spikes that correlate with database authentication attempts.

Compensating Controls: While no direct WAF control can mitigate this client-side logic flaw, ensure that database connections are restricted to trusted, internal-only infrastructure to prevent communication with malicious or untrusted database servers.

Public Exploit Available: No (exploit_available: false)

Given the potential for service disruption and the ease with which a malicious server can trigger this condition, organizations should prioritize upgrading their JDBC driver dependencies. Verify the version in use across all production environments and apply the patch immediately to ensure that connection pools remain resilient against malicious authentication requests.