ongres vulnerabilities

Products

• scram 2
• StackGres 1

Latest ongres CVEs

Newest publication first

1. CVE-2026-78155 Untrusted Search Path in StackGres

   Published 2026-08-23

   Critical·CVSS 9.9 EPSS 0.52%

   privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges

2. CVE-2026-53712 SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms

   Published 2026-07-17

   High·CVSS 8.2 EPSS 0.26%

   SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to 3.3, a flaw in com.ongres.scram:scram-client and com.ongres.scram:scram-common allows an attacker capa...

3. CVE-2025-59432 Timing Attack Vulnerability in SCRAM Authentication

   Published 2025-09-22

   Medium·CVSS 6.6 EPSS 0.70%

   SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises b...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.