Database Technology

PostgreSQL JDBC 42.7.12 fixes CVE-2026-54291, a vulnerability where connections using channelBinding=require silently downgrade from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This occurs when the server presents certificates with algorithms like Ed25519 that lack the expected channel-binding hash. The root cause involves the bundled scram-client library returning an empty byte array instead of failing when it cannot derive the binding hash. This flaw removes man-in-the-middle protection for secure connections.

• Upgrade to JDBC 42.7.12 immediately to restore MITM protection for channelBinding=require connections.
• Vulnerable range is 42.7.4 through 42.7.11; earlier versions are not affected by this specific downgrade logic.
• The issue triggers specifically with Ed25519, Ed448, and post-quantum certificate algorithms.
• The root cause lies in the bundled com.ongres.scram library failing to reject missing binding hashes.

CloudNativePG 1.30.0 introduces a new DatabaseRole CRD for declarative, GitOps-style PostgreSQL role management and a Lease-based mechanism for safer primary election during failover. The release also includes notable security and operational improvements. Additionally, maintenance versions 1.29.2 and 1.28.4 are available, with 1.28.x reaching end-of-life on June 30, 2026.

• Use DatabaseRole CRD for declarative, GitOps-friendly role management
• Leverage Lease-based primitive for safer primary election failover
• Upgrade from 1.28.x before EOL on June 30, 2026
• Consider moving to 1.29 or 1.30 for latest security fixes

The pg_dbms_lock extension has reached version 2.0, a maintenance update that adds support for PostgreSQL 19. This release also aligns with the pg_background v2+ API, dropping support for older pg_background versions. The extension continues to emulate Oracle DBMS_LOCK behavior using PostgreSQL advisory locks, including lock modes, timeouts, and on-commit release settings.

• Update required for PostgreSQL 19 environments using pg_dbms_lock.
• Must upgrade pg_background to v2+ or break extension compatibility.
• Retains Oracle DBMS_LOCK emulation for exclusive/shared locks and timeouts.
• DBMS_LOCK.CONVERT() remains unsupported in this compatibility layer.

The credcheck extension for PostgreSQL has reached version 5.0, offering a comprehensive suite of credential checks triggered during user creation, password changes, and renames. This release allows administrators to define strict rules such as password expiration, reuse policies, brute-force protection via failure limits, and mandatory password changes upon first login. By integrating these checks directly into the authentication lifecycle, organizations can enforce stronger security postures without relying on external tools.

• Enforce password expiration, reuse policies, and minimum age requirements natively during user lifecycle events.
• Mitigate brute-force attacks by defining authentication failure limits and mandatory delays before banning users.
• Ensure compliance by forcing password changes on first login and issuing warnings before expiration.
• Integrate credential validation directly into PostgreSQL via the extension for centralized policy management.