Content Quality: Compact Briefing (515 words raw and with link URLs stripped; 511 excluding markdown symbols; range 300-800). Title is 114 characters (cap 150). Clear structure: overview, per-CVE section, configuration fix, 'What We Don't Know'. Neutral tone, no AI self-reference. No policy violations recorded.
Source Verification: All five snapshots exist, status 200, page body present (none is page chrome only), suspicious_patterns null for all. Hosts raw.githubusercontent.com and github.com are both already in config/source_allowlist.txt (no allowlist change). source-0 (NEWS.md, sha b37bec26...): read in full for 1.26.1; entry dated '2026-10-14 - PgBouncer 1.26.1 - "Only startup once"'. CVE-2026-107350: 1.17.0 through 1.26.0, second StartupMessage during SCRAM auth against a non-existent database, 'An attacker knowing the password of a user listed in `auth_file` could use this to log in as any other user that authenticates using SCRAM, including admins and backend superusers. This requires SCRAM authentication to be used for both users. The impersonated user can come from either `auth_file` or `auth_query`.' CVE-2026-107349: 1.20.0 through 1.26.0, unauthenticated, empty option name such as -c= in options, only exploitable when ignore_startup_parameters is non-empty but lacks options. CVE-2026-107348: 1.21.0 through 1.26.0, integer overflow in packet buffer growth, length above 2^31, only exploitable with max_packet_size 2147483649 or higher (default 2147483647 not affected), reachable pre-auth since 1.23.0, same class as CVE-2026-6668 in a different buffer implementation. All match the article. Fixes entry: ignore_startup_parameters takes precedence over tracked parameters; search_path tracked by default since 1.26.0; 'These bugs will be addressed in a later release.'; adding search_path restores 1.25 behaviour. Matches. The changelog gives no CVSS and no credits, as the article says. source-1 (GitHub release page): release name 'PgBouncer 1.26.1 - Only startup once', datetime 2026-10-14T08:28:57Z (article: 08:28 UTC October 14, correct), embeds the same changelog text. source-2 (GHSA-qcxp-3cx5-3f3g): CVE-2026-107350, High severity, Unreviewed, published Oct 14 2026, CVSS 8.8, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-287 Improper Authentication, description 'allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers'. Package: none listed; affected and patched versions 'Unknown'; no credits section. Article matches (score, vector, CWE). source-3 (GHSA-h8cj-p2h5-hm79): CVE-2026-107349, High, Unreviewed, 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-400 Uncontrolled Resource Consumption, 'An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service'. Article matches. source-4 (GHSA-982p-g5h4-w372): CVE-2026-107348, Moderate, Unreviewed, 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-190 Integer Overflow or Wraparound; mbuf_make_room; 'when max_packet_size is configured above 2147483648' (equivalent to the changelog's 2147483649 or higher for an integer setting). Article matches. Each advisory was checked individually; no cross-advisory generalisation found. Live re-fetch on 2026-10-15: NEWS.md sha256 identical to the snapshot; GitHub API for all three GHSAs returned identical GHSA/CVE ID, severity, score, vector, CWE, type 'unreviewed', published 2026-10-14T18:32Z, zero credits and zero package/version entries; release API: name 'PgBouncer 1.26.1 - Only startup once', published_at 2026-10-14T08:28:57Z, not draft or prerelease. No change since snapshot. Earlier-article link /article/2026-05/11-pgbouncer-1252-... resolves to an existing published article (PgBouncer 1.25.2, four CVEs, shipped May 8, 2026) and the description is accurate.
Factual Accuracy: Every CVE number, version range, condition, CVSS score/vector and CWE traces to the cited snapshots. SCRAM title check: the flaw behind 'a user who knows one password log in as others' is CVE-2026-107350, the 8.8 entry. Both changelog and advisory say the attacker must know the password of a user listed in auth_file (a valid account), and can then log in as any other SCRAM-authenticating user, including admins and superusers. The title is a compressed but not stronger rendering; the body states the SCRAM-for-both-users requirement and the non-existent-database trigger, which the title omits. The summary 'in versions up to 1.26.0' is a simplification (ranges start at 1.17.0, 1.20.0, 1.21.0) but is qualified in the body. Scores are attributed to the GitHub Advisory Database and the article correctly says the changelog gives no ratings and names no credited reporters (advisories list none).
Overall Assessment: Accurate, well-sourced security Briefing; all figures verified individually against snapshots and a live re-fetch. APPROVE.