Lucee Postgresql CVE-2026-54291

Tools and Libraries
1

Hi Lucee team

I’ve noticed that the most recent PostgreSQL extension available is 42.7.10 according to Postgresql Jdbc Extension Extension — Lucee Downloads

That version seems to have a CVE which does not get fixed until version 42.7.12.

I wanted to confirm if you guys have an update in your near term plans to bump the version up to .12.
Or perhaps this is an accepted vulnerability since maybe is not exploitable within Lucee?

Thanks

4 Likes
2

Thanks for flagging this. It’s tracked here: LDEV-6471

For anyone checking their exposure, only connections that set channelBinding=require are affected. The default prefer isn’t.

2 Likes