CVE-2026-107349
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-400, CWE-835
Impact
Unauthenticated remote attackers can hang the entire connection pooler and deny service to all database clients. All they need is network access to the exposed PgBouncer port to send a single malformed startup packet.
Root cause
Parsing an empty parameter name (like '-c=') in the StartupMessage options makes the ignore_startup_parameters list lookup enter an infinite loop.
Affected systems
PgBouncer 1.20.0 through 1.26.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to PgBouncer version higher than 1.26.0 once available. If patching must wait, restrict network access to the PgBouncer port using firewall rules or security groups to allow only trusted client IPs.
$ pgbouncer --versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.