https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T15:45:04.546413+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-14672 CVE-2026-14672 — PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle 2026-09-29T15:45:04.560519+00:00

Affected: PostgreSQL

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.6, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.