PgBouncer 1.26.1 Fixes Three CVEs, Including a SCRAM Flaw That Lets a User Who Knows One Password Log In as Others

Overview

PgBouncer 1.26.1, which the project’s changelog titles “Only startup once”, is dated 2026-10-14 and lists fixes for three CVEs in the PostgreSQL connection pooler, according to the PgBouncer changelog. The GitHub release was published at 08:28 UTC on October 14. The most serious by CVSS score, CVE-2026-107350, concerns SCRAM authentication and affects 1.17.0 through 1.26.0.

What the Release Fixes

CVE-2026-107350. The changelog says PgBouncer 1.17.0 through 1.26.0 processed a second StartupMessage sent during SCRAM authentication when the client connected to a non-existent database. An attacker who knows the password of a user listed in auth_file could use this to log in as any other user that authenticates using SCRAM, including admins and backend superusers, per the changelog. It requires SCRAM authentication to be used for both users, and the impersonated user can come from either auth_file or auth_query. The GitHub Advisory Database entry lists a CVSS 3.1 score of 8.8 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CWE-287, Improper Authentication.

CVE-2026-107349. An unauthenticated client could make PgBouncer 1.20.0 through 1.26.0 spin forever on a CPU core, and thus stop serving all clients, by sending a startup options parameter containing an empty option name such as -c=, according to the changelog. It is only exploitable when ignore_startup_parameters is non-empty but does not contain options. The GitHub Advisory Database entry lists a CVSS 3.1 score of 7.5 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and CWE-400, Uncontrolled Resource Consumption.

CVE-2026-107348. An integer overflow in the packet buffer growth logic of versions 1.21.0 through 1.26.0 could cause PgBouncer to hang in an infinite loop when a client sent a packet header declaring a length above 2^31, per the changelog. The changelog says this is only exploitable when max_packet_size is set to 2147483649 or higher, and that the default of 2147483647 is not affected. It also says the flaw has been reachable before authentication since 1.23.0, and that it is the same class of bug as CVE-2026-6668, but in a different buffer implementation. The GitHub Advisory Database entry lists a CVSS 3.1 score of 5.9 (vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and CWE-190, Integer Overflow or Wraparound.

The scores and CWE identifiers come from GitHub’s advisory database, not from the PgBouncer changelog, which gives no severity ratings. The advisory entries name no credited reporters, and neither does the changelog.

A Configuration Fix in the Same Release

The one non-security entry changes ignore_startup_parameters so that it takes precedence over tracked parameters. According to the changelog, search_path has been tracked by default since 1.26.0, which made ignore_startup_parameters = search_path silently have no effect. The changelog adds that various bugs were reported around tracking of search_path since that release and that “These bugs will be addressed in a later release.” Adding search_path to ignore_startup_parameters now restores the 1.25 behaviour of ignoring it, it says.

What We Don’t Know

None of the sources cited here reports exploitation of the three CVEs. This article did not check the packaging status of 1.26.1 in Linux distributions. The Machine Herald previously reported on a separate set of four PgBouncer CVEs fixed in 1.25.2 on May 8, 2026; the 1.26.1 fixes are a different set.