bouncer-overflow

PgBouncer Crash PoC This repository contains a local proof of concept for a PgBouncer crash caused by an integer overflow in vulnerable PgBouncer versions. The included Docker setup builds PgBouncer 1.25.1, starts a PostgreSQL backend, enables SCRAM-SHA-256 authentication, and runs poc.py against...

Fedora 43 : pgbouncer (2026-343329cfec)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-343329cfec advisory. Update to 1.26.1. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 44 : pgbouncer (2026-20b7549bd1)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-20b7549bd1 advisory. Update to 1.26.1. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

BIT-PGBOUNCER-2026-107350 Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...

BIT-PGBOUNCER-2026-107349 Infinite loop on empty option name in startup options parameter in PgBouncer

An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...

BIT-PGBOUNCER-2026-107348 Integer overflow causes an infinite loop in message buffer growth in PgBouncer

Integer overflow in the message buffer growth logic mbufmakeroom in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when maxpacketsize is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow,...

PostgreSQL PgBouncer Resource Exhaustion DoS

The vulnerability of the PostgreSQL PgBouncer connection pool software is related to an uncontrolled resource consumption when processing parameters like options and ignorestartupparameters. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

PostgreSQL PgBouncer Authentication Bypass

The vulnerability of the PostgreSQL PgBouncer connection pool software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms and gain unauthorized access to the system...

PostgreSQL PgBouncer Integer Overflow DoS

The vulnerability of the PostgreSQL PgBouncer connection pool software relates to integer overflow when processing the maxpacketsize parameter. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: pgbouncer: pgbouncer-1.26.1-1.hum1 aarch64, s390x, x8664 pgbouncer-1.26.1-1.hum1.src src...

pgbouncer: pgbouncer: Privilege escalation via secondary startup message during SCRAM authentication

A flaw was found in PgBouncer. An improper authentication vulnerability allows a remote attacker possessing valid credentials for any listed user to impersonate any other user configured with Salted Challenge Response Authentication Mechanism SCRAM, including PgBouncer administrators and backend...

pgbouncer: pgbouncer: Denial of Service via empty parameter name in startup options

A flaw was found in PgBouncer. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a startup message that contains an empty parameter name in its options. This causes PgBouncer to enter an infinite loop during startup parameter processing, consuming high CPU resources...

pgbouncer: pgbouncer: Denial of Service via integer overflow in message buffer growth

A flaw was found in PgBouncer. An integer overflow in the message buffer growth logic allows a remote attacker to cause a Denial of Service DoS when a large maximum packet size is configured. By sending a specially crafted packet header declaring an excessively large length, an attacker can trigg...

CVE-2026-107349 affecting package pgbouncer for versions less than 1.26.1-1

CVE-2026-107349 affecting package pgbouncer for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-107350 affecting package pgbouncer for versions less than 1.26.1-1

CVE-2026-107350 affecting package pgbouncer for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-107348 affecting package pgbouncer for versions less than 1.26.1-1

CVE-2026-107348 affecting package pgbouncer for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-107350

A flaw was found in PgBouncer. An improper authentication vulnerability allows a remote attacker possessing valid credentials for any listed user to impersonate any other user configured with Salted Challenge Response Authentication Mechanism SCRAM, including PgBouncer administrators and backend...

CVE-2026-107349

A flaw was found in PgBouncer. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a startup message that contains an empty parameter name in its options. This causes PgBouncer to enter an infinite loop during startup parameter processing, consuming high CPU resources...

UBUNTU-CVE-2026-107350

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...

UBUNTU-CVE-2026-107348

Integer overflow in the message buffer growth logic mbufmakeroom in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when maxpacketsize is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow,...