PgBouncer 1.26.1 released to fix authentication bypass and DoS vulnerabilities

The PgBouncer 1.26.1 release addresses three security vulnerabilities. These include a critical authentication bypass affecting SCRAM users and two Denial of Service (DoS) flaws caused by infinite loops.

Security vulnerabilities addressed

• CVE-2026-107350: An authentication bypass where a client with one SCRAM user's password can log in as any other user, including superusers, due to a second StartupMessage being processed during authentication to a non-existent database.
• CVE-2026-107349: A DoS vulnerability causing an infinite loop via unauthenticated clients when an empty option name is present in startup options.
• CVE-2026-107348: A DoS vulnerability causing an infinite loop due to an integer overflow in packet buffer growth logic when max_packet_size is set above default.
• Behavioral change: ignore_startup_parameters now takes precedence over tracked parameters, restoring the behavior seen in version 1.25.

Why it matters

Users of PgBouncer as a connection pooler for PostgreSQL should update immediately to prevent unauthorized access and service disruptions.