34 matches found
BIT-PGBOUNCER-2026-107350 Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...
BIT-PGBOUNCER-2026-107349 Infinite loop on empty option name in startup options parameter in PgBouncer
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
UBUNTU-CVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...
UBUNTU-CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
DEBIAN-CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
AZL-108192 CVE-2026-107349 affecting package pgbouncer 1.25.2-1
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
CVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...
CVE-2026-107350
PgBouncer versions 1.17.0 through 1.26.0 are vulnerable to an authentication bypass during SCRAM authentication . An attacker who knows the password of a user listed in auth_file can log in as any other user, including PgBouncer admin users and backend superusers . The root cause is that the syst...
CVE-2026-107350 Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...
CVE-2026-107350 Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...
CVE-2026-107349 Infinite loop on empty option name in startup options parameter in PgBouncer
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
EUVD-2026-101499
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
CVE-2026-107349
The database connection pooler PgBouncer (versions 1.20.0 through 1.26.0) contains an infinite loop vulnerability. An unauthenticated remote attacker can cause a denial of service by sending a StartupMessage where the options parameter contains an empty parameter name (e.g., -c=). This causes the...
CVE-2026-107349 Infinite loop on empty option name in startup options parameter in PgBouncer
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
CVE-2026-107349: Loop with Unreachable Exit Condition
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...
PT-2026-122672
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore startup parameters list lookup loop forever. Because PgBouncer...