fix(security): upgrade postgresql-jdbc to 42.7.11 to remediate CVE-2026-42198 by subrata71 · Pull Request #41812 · appsmithorg/appsmith

subrata71 · 2026-05-14T08:08:37Z

Summary

CVE-2026-42198 (CVSS 7.5, HIGH) is a client-side denial-of-service in the PostgreSQL JDBC driver's SCRAM-SHA-256 handshake that affects every release in the range 42.2.0 ≤ v < 42.7.11. A malicious or compromised PostgreSQL server can respond with an arbitrarily large PBKDF2 iteration count, causing the JDBC client to burn an entire CPU core inside PBKDF2 with no effective cap. loginTimeout does not mitigate the issue.
The vulnerable driver is shipped inside postgresPlugin and is used to connect to every Appsmith user's Postgres datasource. Any authenticated user with datasource-creation rights can point a datasource at a hostile PG server and wedge Appsmith server CPU / Hikari pool — so blast radius is broader than typical infra-side CVEs.
Bumps the pinned org.postgresql:postgresql override in postgresPlugin from 42.6.1 → 42.7.11, which introduces the new scramMaxIterations connection property (default 100_000) that caps iterations before the PBKDF2 computation runs.

The previous comment on this override (Remove once spring-boot is at least at 3.1.9 or 3.2.3) was already stale — we're on Spring Boot 3.5.12, whose BOM manages org.postgresql:postgresql to 42.7.10, which is also in the vulnerable range. The override is refreshed to reflect the new floor for removal (Spring Boot managing ≥ 42.7.11).

⚠️ Breaking change for release notes coordination

pgjdbc 42.7.9 (pgjdbc#3866) rewrote PGInterval.getValue() for ~32× throughput. As a side effect, the string representation now omits zero-valued components. The postgres plugin emits this exact string for INTERVAL columns (PostgresPlugin.java, INTERVAL_TYPE_NAME branch: resultSet.getObject(i).toString()), so user-visible query results change shape:

	Before (42.6.1)	After (42.7.11)
`1 year 5 months 2 hours`	`1 years 5 mons 0 days 2 hours 0 mins 0.0 secs`	`1 years 5 mons 2 hours`
`0 seconds`	`0 years 0 mons 0 days 0 hours 0 mins 0.0 secs`	`0.0 secs`

Impact for users: Any Appsmith app that regexes / equality-checks the string representation of an INTERVAL column will need to adapt. Apps that just display the value in a widget will show a more compact label.

Action for release notes: explicit "Breaking change" callout under the postgres plugin, including the before/after example, so customers can audit their queries before upgrading.

The 4 PostgresPluginTest assertions that pinned the legacy 6-field shape are updated to match.

Test plan

mvn -pl appsmith-plugins/postgresPlugin -am compile — clean
mvn -pl appsmith-plugins/postgresPlugin -am test-compile — clean
mvn -pl appsmith-plugins/postgresPlugin test (testcontainers PG) — 66 tests, 0 failures
mvn -pl appsmith-plugins/postgresPlugin dependency:tree confirms org.postgresql:postgresql:jar:42.7.11:compile
Deploy preview / DP smoke: create a Postgres datasource (Supabase or managed PG), run SELECT now() - '...'::interval AS d style queries, confirm result shape is the new compact form and the connection still completes successfully
Release-notes ticket filed alongside this PR

References

CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-42198
pgjdbc 42.7.11 release notes: https://jdbc.postgresql.org/changelogs/2026-04-28-42/
PGInterval format-change PR: perf: optimize PGInterval.getValue() by replacing String.format with StringBuilder pgjdbc/pgjdbc#3866

Summary by CodeRabbit

Chores
- Updated PostgreSQL driver to v42.7.11 with security and SCRAM-SHA-256 improvements.
Bug Fixes
- Interval/DateTime output now uses a more compact, consistent formatting (removes redundant zero components and fractional seconds).
Tests
- Regression and unit tests updated to reflect the new interval display format.

Automation

/ok-to-test tags="@tag.All"

Tip

🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/25859949356
Commit: a9b1412
Cypress dashboard.
Tags: @tag.All
Spec:

Thu, 14 May 2026 13:52:44 UTC

…26-42198 CVE-2026-42198 (CVSS 7.5, HIGH) is a client-side denial-of-service in the PostgreSQL JDBC driver's SCRAM-SHA-256 handshake (affects 42.2.0 through 42.7.10). A malicious or compromised PostgreSQL server can respond with an arbitrarily large PBKDF2 iteration count, causing the client to burn CPU inside PBKDF2 with no effective cap. loginTimeout does not mitigate the issue. In the postgres plugin this is reachable by any authenticated user with datasource-creation rights, who can point a datasource at a hostile server and wedge Appsmith server CPU / Hikari pool. Bump the pinned org.postgresql:postgresql override in postgresPlugin from 42.6.1 to 42.7.11, which introduces scramMaxIterations (default 100,000) to cap iterations before the PBKDF2 computation runs. Refresh the override comment to reflect the current Spring Boot version (3.5.12, which manages 42.7.10) and the new floor for removing the override. Behavior change to coordinate in release notes ---------------------------------------------- pgjdbc 42.7.9 (PR pgjdbc#3866) rewrote PGInterval.getValue() for ~32x throughput and as a side effect now omits zero-valued components from the string representation. The postgres plugin emits this exact string for INTERVAL columns (PostgresPlugin.java, INTERVAL_TYPE_NAME branch: resultSet.getObject(i).toString()). User-visible diff: before: \"1 years 5 mons 0 days 2 hours 0 mins 0.0 secs\" after: \"1 years 5 mons 2 hours\" Apps that regex / equality-check INTERVAL strings (rather than parsing them with a library) will need to adapt. The four PostgresPluginTest assertions that pinned the legacy shape are updated to the new shape. Verification ------------ mvn -pl appsmith-plugins/postgresPlugin test Tests run: 66, Failures: 0, Errors: 0, Skipped: 0 (testcontainers PG) mvn -pl appsmith-plugins/postgresPlugin dependency:tree org.postgresql:postgresql:jar:42.7.11:compile Note: committed with --no-verify because the husky pre-commit hook duplicates staged files at wrong paths under sibling worktrees. Spotless formatting was applied manually before commit via mvn spotless:apply on app/server/appsmith-plugins/postgresPlugin. Will be revisited separately.

coderabbitai · 2026-05-14T08:09:14Z

Walkthrough

PostgreSQL JDBC driver bumped to 42.7.11 in the Postgres plugin POM; server unit tests and Cypress E2E tests updated to expect the driver’s new compact interval string formatting.

Changes

PostgreSQL Driver Upgrade

Layer / File(s)	Summary
PostgreSQL driver dependency upgrade `app/server/appsmith-plugins/postgresPlugin/pom.xml`	PostgreSQL driver override updated to `org.postgresql:postgresql:42.7.11`; inline comment updated to reference CVE-2026-42198 / SCRAM-SHA-256 PBKDF2 DoS fix.
Interval formatting test updates `app/server/appsmith-plugins/postgresPlugin/src/test/java/com/external/plugins/PostgresPluginTest.java`, `app/client/cypress/e2e/Regression/ServerSide/Postgres_DataTypes/DateTime_Spec.ts`	Server unit tests (four assertions across test methods) and multiple Cypress assertions updated to expect compact interval strings (e.g., `1 years 5 mons 2 hours`) and to remove redundant zero-value/fractional-second components.

🎯 2 (Simple) | ⏱️ ~10 minutes

A tiny bump, a gentle fix,
Intervals now shed zeroed ticks.
Driver patched, the tests align,
Compact strings and builds — all fine. ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately reflects the main change: upgrading postgresql-jdbc to address CVE-2026-42198, which is the primary objective of this PR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	PR description is comprehensive, well-structured, and includes all critical information: CVE details, impact analysis, breaking change callout, test results, and action items.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/cve-2026-42198-pgjdbc

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

subrata71 · 2026-05-14T08:36:45Z

/build-deploy-preview skip-tests=true

github-actions · 2026-05-14T08:37:11Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/25850461096.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 41812.
recreate: .
base-image-tag: .

github-actions · 2026-05-14T08:42:37Z

Deploy-Preview-URL: https://ce-41812.dp.appsmith.com

…ompact format CE PR CI surfaced 5 failures in DateTime_Spec.ts after the pgjdbc bump. Same root cause as the unit-test updates: pgjdbc 42.7.9 (PR pgjdbc#3866) changed PGInterval.getValue() to (a) omit zero-valued components and (b) drop the trailing .0 from integer whole seconds. The Cypress assertions hardcoded the legacy 6-field format, so each one needs to be rewritten. Mapping the 7 hardcoded strings: "0 years 11 mons 29 days 23 hours 0 mins 0.0 secs" -> "11 mons 29 days 23 hours" "0 years 1 mons 0 days 0 hours 0 mins 0.0 secs" -> "1 mons" "0 years 0 mons 1 days 0 hours 0 mins 0.0 secs" -> "1 days" "6 years 5 mons 4 days 3 hours 2 mins 1.0 secs" -> "6 years 5 mons 4 days 3 hours 2 mins 1 secs" "0 years 0 mons 3 days 4 hours 5 mins 6.0 secs" -> "3 days 4 hours 5 mins 6 secs" "1 years 3 mons 2 days 6 hours 4 mins 5.0 secs" -> "1 years 3 mons 2 days 6 hours 4 mins 5 secs" "1 years 2 mons 0 days 0 hours 0 mins 0.0 secs" -> "1 years 2 mons" Each expected value matches what CI observed as the actual response. Prettier collapsed the now-shorter assertions to single lines. Committed with --no-verify due to the same husky path-resolution issue under worktrees as the previous commit on this branch.

subrata71 requested a review from sharat87 as a code owner May 14, 2026 08:08

subrata71 self-assigned this May 14, 2026

subrata71 removed the request for review from sharat87 May 14, 2026 08:15

subrata71 added the ok-to-test Required label for CI label May 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): upgrade postgresql-jdbc to 42.7.11 to remediate CVE-2026-42198#41812

fix(security): upgrade postgresql-jdbc to 42.7.11 to remediate CVE-2026-42198#41812
subrata71 wants to merge 2 commits into
releasefrom
fix/cve-2026-42198-pgjdbc

subrata71 commented May 14, 2026 •

edited by github-actions Bot

Loading

Uh oh!

coderabbitai Bot commented May 14, 2026 •

edited

Loading

❌ Failed checks (1 warning)

Uh oh!

subrata71 commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

subrata71 commented May 14, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

⚠️ Breaking change for release notes coordination

Test plan

References

Summary by CodeRabbit

Automation

Uh oh!

coderabbitai Bot commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

subrata71 commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

subrata71 commented May 14, 2026 •

edited by github-actions Bot

Loading

coderabbitai Bot commented May 14, 2026 •

edited

Loading