GHSA-24rp-q3w6-vc56 · Severity: critical · Ecosystem: maven — org.postgresql:postgresql vulnerable to SQL Injection via line comment generation
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
Conclusion & alert: CVE-2024-1597 is rated High Risk (76.2/100): CVSS Critical severity, with high exploitation likelihood (EPSS 4.81%, 91th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +4.46% over the last day, indicating growing attacker interest. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.35% | 4.81% | +4.46% |
| 2 | 2026-05-22 | 0.55% | 0.35% | -0.20% |
| 3 | 2026-03-04 | — | 0.55% | — |
Full EPSS history (28 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 10.0 | 3.1 | CRITICAL |
|
3.9 | 6.0 | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 |
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
GHSA-24rp-q3w6-vc56 · Severity: critical · Ecosystem: maven — org.postgresql:postgresql vulnerable to SQL Injection via line comment generation
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
critical | CVE-2024-1597: 1 source package rows (java-postgresql-jdbc); 6 state rows across 6 repos (3.19-community, 3.20-community, 3.21-community, 3.22-community, 3.23-community, edge-community); fixed 6, open 0. | https://security.alpinelinux.org/vuln/CVE-2024-1597 |
debian
|
not yet assigned | CVE-2024-1597 not yet assigned priority: Debian including 1 source packages (libpgjava), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2024-1597 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2024-1597 |
suse
|
critical | — | https://www.suse.com/security/cve/CVE-2024-1597/ |
ubuntu
|
medium | CVE-2024-1597 medium priority: Ubuntu including 1 source packages (libpgjava), 11 status rows across 11 suites (bionic, focal, jammy, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): needs-triage 5, not-affected 4, ignored 1, released 1. | https://ubuntu.com/security/CVE-2024-1597 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| postgresql | postgresql_jdbc_driver | < 42.2.28 | cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* |
| postgresql | postgresql_jdbc_driver | >= 42.3.0, < 42.3.9 | cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* |
| postgresql | postgresql_jdbc_driver | >= 42.4.0, < 42.4.4 | cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* |
| postgresql | postgresql_jdbc_driver | >= 42.5.0, < 42.5.5 | cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* |
| postgresql | postgresql_jdbc_driver | >= 42.6.0, < 42.6.1 | cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* |
| postgresql | postgresql_jdbc_driver | >= 42.7.0, < 42.7.2 | cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* |
| fedoraproject | fedora | 40 | cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* |