| From: | PgBouncer via PostgreSQL Announce <announce-noreply(at)postgresql(dot)org> |
|---|---|
| To: | PostgreSQL Announce <pgsql-announce(at)lists(dot)postgresql(dot)org> |
| Subject: | PgBouncer 1.26.1 released - Fixes three CVEs |
| Date: | 2026-10-14 10:48:44 |
| Message-ID: | 179197492458.2048043.772800758709695706@wrigleys.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-announce |
PgBouncer 1.26.1 has been released. This release fixes three CVEs:
1. CVE-2026-107350: Authentication bypass, allowing a client that knows the password of one SCRAM user to log in as any other SCRAM user, including admins and backend superusers. Caused by a second StartupMessage being processed during SCRAM authentication when connecting to a non-existent database.
2. CVE-2026-107349: DoS due to infinite loop, triggerable by unauthenticated clients. Caused by an empty option name in the startup `options` parameter, when `ignore_startup_parameters` is non-empty but does not contain `options`.
3. CVE-2026-107348: DoS due to infinite loop, triggerable by unauthenticated clients. Caused by an integer overflow in the packet buffer growth logic, only when `max_packet_size` is set above its default.
It also makes `ignore_startup_parameters` take precedence over tracked parameters, so that `ignore_startup_parameters = search_path` restores the 1.25 behaviour of ignoring `search_path`.
See [https://www.pgbouncer.org/2026/10/pgbouncer-1-26-1](https://www.pgbouncer.org/2026/10/pgbouncer-1-26-1) for more information, the detailed changelog, and download links.
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Gavin M. Roy via PostgreSQL Announce | 2026-10-14 10:48:56 | Introducing pglifecycle 2.0 beta |
| Previous Message | JDBC Project via PostgreSQL Announce | 2026-10-09 13:05:41 | 2026-10-07: PostgreSQL JDBC 42.7.14 Security update for multiple CVE's |