CVE-2026-107349

A flaw was found in PgBouncer. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a startup message that contains an empty parameter name in its options. This causes PgBouncer to enter an infinite loop during startup parameter processing, consuming high CPU resources...

PT-2026-113988

Name of the Vulnerable Software and Affected Versions PgBouncer versions 1.20.0 through 1.26.0 Description An infinite loop occurs when processing a StartupMessage where the options parameter contains an empty parameter name, such as "-c=". This causes the ignore startup parameters list lookup to...