PostgreSQL JDBC 42.7.12 fixes silent SCRAM channel binding downgrade

PostgreSQL JDBC 42.7.12 addresses CVE-2026-54291, where a driver set to channelBinding=require could silently fall back from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256 while the connection continued. Teams are advised to upgrade all runtimes that open PostgreSQL connections and verify the negotiated authentication mechanism, not just the configuration value.

• CVE-2026-54291 allows fallback to SCRAM-SHA-256 under channelBinding=require
• The fix ships in PostgreSQL JDBC driver 42.7.12
• Verify the negotiated mechanism, not just the configured value
• Treat mixed deployment states as temporary and track exceptions