Quick Links

pgbouncer updated to version 1.26.1-1.pgdg+1

From:	apt(dot)postgresql(dot)org Repository Update <noreply(at)postgresql(dot)org>
To:	PostgreSQL on Debian and Ubuntu <pgsql-pkg-debian(at)lists(dot)postgresql(dot)org>
Subject:	pgbouncer updated to version 1.26.1-1.pgdg+1
Date:	2026-10-19 15:01:43
Message-ID:	E1xIorv-00000006cuQ-2QO3@atalia.postgresql.org
Views:	Whole Thread \| Raw Message \| Download mbox \| Resend email
Thread:
Lists:	pgsql-pkg-debian

The package pgbouncer was updated on apt.postgresql.org.

apt-listchanges: Changelogs
---------------------------

pgbouncer (1.26.1-1.pgdg+1) sid-pgdg; urgency=medium

* Rebuild for sid-pgdg.
* No source changes.

-- PostgreSQL on Debian and Ubuntu <pgsql-pkg-debian(at)lists(dot)postgresql(dot)org> Wed, 14 Oct 2026 12:55:24 +0200

pgbouncer (1.26.1-1) unstable; urgency=medium

* New upstream version 1.26.1.
* Fix CVE-2026-107350: PgBouncer 1.17.0 through 1.26.0 processed a second
StartupMessage sent during SCRAM authentication when the client
connected to a non-existent database. An attacker knowing the password
of a user listed in `auth_file` could use this to log in as any other
user that authenticates using SCRAM, including admins and backend
superusers. This requires SCRAM authentication to be used for both
users. The impersonated user can come from either `auth_file` or
`auth_query`.
* Fix CVE-2026-107349: An unauthenticated client could make PgBouncer
1.20.0 through 1.26.0 spin forever on a CPU core, and thus stop serving
all clients, by sending a startup `options` parameter containing an
empty option name such as `-c=`. This is only exploitable when
`ignore_startup_parameters` is non-empty but does not contain `options`.
* Fix CVE-2026-107348: An integer overflow in the packet buffer growth
logic of PgBouncer 1.21.0 through 1.26.0 could cause PgBouncer to hang
in an infinite loop when a client sent a packet header declaring a
length above 2^31. This is only exploitable when `max_packet_size` is
set to 2147483649 or higher, the default of 2147483647 is not affected.
Since 1.23.0 this is reachable before authentication. This is the same
class of bug as CVE-2026-6668, but in a different buffer implementation.

-- Christoph Berg <myon(at)debian(dot)org> Wed, 14 Oct 2026 12:55:24 +0200

pgbouncer (1.26.0-6) unstable; urgency=medium

* Run a reduced smoke test set on buildd instead of the full upstream
suite. The timing- and load-sensitive tests kept failing on the slower
buildd architectures; the remaining tests cover the basic startup,
authentication and admin console paths and have been stable on all
architectures since 1.25.0-1. The full upstream suite can still be run
manually with "make check"; autopkgtest keeps its own connection test.
* Drop the now redundant test stabilization patches: test_notify_queue,
test-async-task-cleanup, test-flaky-timing-asserts, 1481.patch,
test-prepared-pipeline-stability, test-slow-arch-connect-timeout.
* debian/tests/connect: Drop "restart" test, it is unstable.

-- Christoph Berg <myon(at)debian(dot)org> Thu, 01 Oct 2026 23:11:14 +0200

pgbouncer (1.26.0-5) unstable; urgency=medium

* Extend connection timeout for slow tests on riscv64.

-- Christoph Berg <myon(at)debian(dot)org> Thu, 01 Oct 2026 12:33:14 +0200

New version 1.26.1-1.pgdg+1:

The public mirrors serving apt.postgresql.org are synced hourly,
the updated packages will be available there shortly.

Browse pgsql-pkg-debian by date

	From	Date	Subject
Next Message	eric asiedu	2026-10-22 01:57:17	Request for PGDG Repository Signing-Key Verification — PostgreSQL 16.10
Previous Message	apt.postgresql.org Repository Update	2026-10-15 15:59:40	plr updated to version 1:8.4.8.10-1.pgdg+1