PgBouncer
PgBouncer Security Releases - October 2026
pgbouncer-2026-10 Oct 1, 2026 Source: Vendor
PgBouncer security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-107348
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3 matching , clear filters
CVE-2026-107348
BR2026-0000-031156
PgBouncer
unclaimed
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured abov...
Credited as Thanks to Brian Cosgrove (@cosgroveb) for finding and reporting this issue
CVE-2026-107349
BR2026-0000-031157
PgBouncer
unclaimed
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name...
Credited as Thanks to Jackds Security (@jackds-security) for finding and reporting this issue
CVE-2026-107350
BR2026-0000-031158
PgBouncer
unclaimed
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, ...
Credited as Thanks to Dave Aitel (@daveaitel-openai, OpenAI) for finding and reporting this issue