CVE-2026-42198: Scram Client Unbounded Pbkdf2
Generating a SCRAM client final message without validating the PBKDF2 iteration count allows a malicious server to cause a client-side Denial of Service (DoS). Retrieve the iteration count using getIterationCount() and enforce a maximum limit before proceeding.
Javagreprules fetch cve-2026-42198-scram-client-unbounded-pbkdf2 --engine opengrepDescription
Generating a SCRAM client final message without validating the PBKDF2 iteration count allows a malicious server to cause a client-side Denial of Service (DoS). Retrieve the iteration count using getIterationCount() and enforce a maximum limit before proceeding.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.