CVE-2026-3960: Cve 2026 3960 Incomplete Jdbc Denylist Missing Postgresql Params
JDBC parameter denylist contains MySQL-specific entries such as "autoDeserialize" but is missing critical PostgreSQL JDBC driver parameters ("socketFactory", "socketFactoryArg"). An attacker can bypass this denylist by supplying a jdbc:postgresql: URL with socketFactory pointing to an arbitrary Java class (e.g., ClassPathXmlApplicationContext) to achieve una
Javagreprules fetch cve-2026-3960-cve-2026-3960-incomplete-jdbc-denylist-missing-postgresql-params --engine opengrepDescription
JDBC parameter denylist contains MySQL-specific entries such as "autoDeserialize" but is missing critical PostgreSQL JDBC driver parameters ("socketFactory", "socketFactoryArg"). An attacker can bypass this denylist by supplying a jdbc:postgresql: URL with socketFactory pointing to an arbitrary Java class (e.g., ClassPathXmlApplicationContext) to achieve una
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.