Notable Changes

Notable changes

Security

• fix: a requireAuth value that excludes every authentication method, such as !password,!md5,!gss,!sspi,!scram-sha-256,!none, now refuses every method. A connection with such a value fails with SQLState 08004 and the message Authentication method is not allowed by requireAuth; with channelBinding=require also set, the channel binding message comes instead, as the security page describes. A value without a method in it, such as ,, now fails with SQLState 22023 and the message Invalid authentication method: <value>, where <value> is the requireAuth value, for example Invalid authentication method: ,. Releases 42.7.11 through 42.7.13 treated both kinds of value as if requireAuth were not set, and accepted any method the server asked for, including cleartext password. After the upgrade, a configuration with such a value can no longer connect. Replace the value with a positive list of the methods your server uses. See the Security Advisory for more detail. The following CVE-2026-107314 has been issued.
• fix: when an application sends a value shorter than its declared length, for example a ByteStreamWriter whose getLength() is larger than what writeTo() writes, the driver pads the value to the declared length with zeros. Releases 42.7.4 through 42.7.13 padded it with bytes of messages sent earlier on the same connection, so the stored value could contain SQL text and parameter values of earlier statements. See the Security Advisory for more detail. The following CVE-2026-107315 has been issued.