Skip to main content
HIGH

CVE-2022-31197

CVSS v3

8

HIGH

EPSS Score

2.2 %

exploit probability, as of 2026-10-19

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Get an alert for each new CVE published for postgresql.

Set up CVE WatchFree account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • org.postgresql:postgresqlMavenfrom 42.3.0 · fixed in 42.3.7
  • postgresql-jdbc-driverBitnamiall versions · fixed in 42.2.26
  • postgresql-jdbcAlmaLinux:9all versions · fixed in 42.2.18-6.el9_1

Vendor advisories

  • CVE-2022-31197 Red Hat Product Security5 products fixed · 180 known affected

    postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names

    quarkus-jdbc-postgresql-deployment as a component of Red Hat build of Apicurio Registry 2 · jdbc-postgresql as a component of Red Hat Decision Manager 7 · autocorr-af (libreoffice:flatpak) as a component of Red Hat Enterprise Linux 8

  • RHSA-2023:1006 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat build of Quarkus 2.7.7 release and security update

  • RHSA-2023:0318 Red Hat Product Security2 products fixed

    Red Hat Security Advisory: postgresql-jdbc security update

  • RHSA-2022:9023 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat build of Quarkus 2.13.5 release and security update

  • RHSA-2022:8652 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat Fuse 7.11.1 release and security update

Full record on NVD

Description

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue.

Technical details

Published
2022-08-03

Frequently asked questions

What is CVE-2022-31197?

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue.

Is CVE-2022-31197 actively exploited?

Active exploitation of CVE-2022-31197 has not been confirmed. Its EPSS score was 2.2% on 2026-10-19, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2022-31197?

CVE-2022-31197 has a CVSS v3 base score of 8 (HIGH severity).

Running postgresql? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, October 2026Search CVEs

Already have an account? Open CVE WatchNo credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database