CVE-2025-2291

CVE-2025-2291 affects PgBouncer; the flaw arises because auth_query does not respect the PostgreSQL VALID UNTIL expiry, allowing login with an already expired password. The issue impacts versions older than the fixed release (upstream 1.24.1 line; many advisories reference versions < 1.24.1-1 or

CVE-2025-2291

Password can be used past expiry in PgBouncer due to authquery not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password...

CVE-2025-2291 PgBouncer default auth_query does not take Postgres password expiry into account

Password can be used past expiry in PgBouncer due to authquery not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password...

CVE-2025-2291 PgBouncer default auth_query does not take Postgres password expiry into account

Password can be used past expiry in PgBouncer due to authquery not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password...

PT-2025-16876 · Pgbouncer +3 · Pgbouncer +3

Name of the Vulnerable Software and Affected Versions: PgBouncer versions prior to 1.24.1 Description: The issue allows an attacker to log in with an already expired password due to PgBouncer's auth query not considering Postgres's VALID UNTIL value. This enables the use of passwords past their...

PgBouncer 安全漏洞

PgBouncer is an open source lightweight connection pool for PostgreSql from the PgBouncer community. A security vulnerability exists in PgBouncer that stems from authquery not taking into account the VALID UNTIL value of Postgres, which could lead to logging in with an expired password...

Linux Distros Unpatched Vulnerability : CVE-2021-3935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When PgBouncer is configured to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established,...

CVE-2021-3672 affecting package pgbouncer for versions less than 1.24.1-1

CVE-2021-3672 affecting package pgbouncer for versions less than 1.24.1-1. This CVE either no longer is or was never applicable...

CVE-2021-3672 affecting package pgbouncer 1.16.1-1

CVE-2021-3672 affecting package pgbouncer 1.16.1-1. This CVE either no longer is or was never applicable...

Photon OS 5.0: Pgbouncer PHSA-2023-5.0-0140

An update of the pgbouncer package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-0140. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 4.0: Pgbouncer PHSA-2022-4.0-0267

An update of the pgbouncer package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2022-4.0-0267. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

BIT-PGBOUNCER-2021-3935

When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1...

Critical Photon OS Security Update - PHSA-2023-5.0-0140

Updates of 'pgbouncer', 'memcached' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2023-5.0-91-0140

Updates of 'pgbouncer', 'memcached' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2022-0533

Updates of 'libtasn1', 'go', 'pgbouncer', 'curl' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-4.0-0267

Updates of 'pgbouncer', 'openssl' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-0267

Updates of 'pgbouncer', 'openssl' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-3.0-0473

Updates of 'pgbouncer' packages of Photon OS have been released...

The vulnerability of the PgBouncer connection pool program in PostgreSQL allows for unauthorized access to sensitive data. By not properly securing the SQL query structure, attackers can gain access to confidential information, compromise its integrity, and cause service failures.

The vulnerability of the PostgreSQL PgBouncer connection pool program lies in the fact that the data received from the initial request message is treated as already decoded data. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity,...

Malicious code in helium-pgbouncer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a35918caba67fee06e074a8eb6c66a80bc8b1aa2d443215ce191780d50dc453d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...