# PgBouncer 1.26.1 released to fix authentication bypass and DoS vulnerabilities

> **Key takeaway:** PgBouncer 1.26.1 addresses a critical authentication bypass and two Denial of Service vulnerabilities.

**Published:** 2026-10-14T00:00:00+00:00 
**Source:** PostgreSQL Official News 
**Category:** databases-storage 
**Canonical URL:** https://fosswire.org/news/pgbouncer-1261-released-to-fix-authentication-bypass-and-dos.html 

## Summary
The PgBouncer 1.26.1 release addresses three security vulnerabilities. These include a critical authentication bypass affecting SCRAM users and two Denial of Service (DoS) flaws caused by infinite loops.

## Security vulnerabilities addressed
- **CVE-2026-107350**: An authentication bypass where a client with one SCRAM user's password can log in as any other user, including superusers, due to a second StartupMessage being processed during authentication to a non-existent database.
- **CVE-2026-107349**: A DoS vulnerability causing an infinite loop via unauthenticated clients when an empty option name is present in startup options.
- **CVE-2026-107348**: A DoS vulnerability causing an infinite loop due to an integer overflow in packet buffer growth logic when **max_packet_size** is set above default.
- **Behavioral change**: **ignore_startup_parameters** now takes precedence over tracked parameters, restoring the behavior seen in version 1.25.

## Why it matters
Users of PgBouncer as a connection pooler for PostgreSQL should update immediately to prevent unauthorized access and service disruptions.