Skip to content
fr Sign in
5.9 Medium

CVE-2026-107348 Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a…

Description

Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.

Affected products and versions

Product Affected versions Fixed in
pgbouncer 1.21 1.21.0 → < 1.26.1 1.26.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of pgbouncer

The 13 CVEs of pgbouncer →
CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user… 8.8 High CVE-2026-107349 An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of… 7.5 High CVE-2026-19888 Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2… 7.5 High CVE-2026-6668 Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker… 7.5 High
Track this CVE