# PgBouncer 1.26.1 released - Fixes three CVEs

> **Key Architectural Takeaway:** PgBouncer 1.26.1 has been released.

**Published:** 2026-10-14T00:00:00+00:00 
**Source:** PostgreSQL Official News 
**Category:** databases-storage 
**Canonical URL:** https://fosswire.org/news/pgbouncer-1261-released-fixes-three-cves.html 

## Executive Summary
PgBouncer 1.26.1 has been released. This release fixes three CVEs: CVE-2026-107350: Authentication bypass, allowing a client that knows the password of one SCRAM user to log in as any other SCRAM user, including admins and backend superusers. Caused by a second StartupMessage being processed during SCRAM authentication when connecting to a non-existent database. CVE-2026-107349: DoS due to infinite loop, triggerable by unauthenticated clients.

## Architectural & Systems Analysis
From an offensive security, vulnerability mitigation, and systems audit perspective:

- **Exploit Vector Analysis:** Evaluates unprivileged user namespaces, buffer boundaries, or cryptographic flaws.
- **Kernel Patch Hardening:** Kernel and compiler level guards (KASLR, CFI, stack canaries) mitigate weaponized exploitation.
- **Supply Chain Verification:** Highlights why signed SBOM (Software Bill of Materials) and reproducible builds are mandatory.

## Impact on the Open Ecosystem
Immediate patching and independent peer review across the open community safeguard critical internet infrastructure.