CVE-2026-107349

A flaw was found in PgBouncer. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a startup message that contains an empty parameter name in its options. This causes PgBouncer to enter an infinite loop during startup parameter processing, consuming high CPU resources...

PT-2026-113988

An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore startup parameters list lookup loop forever. Because PgBouncer...