PgBouncer vulnerabilities
We track 8 vulnerabilities in PgBouncer products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest PgBouncer vulnerabilities
- 8.8 High severity
PgBouncer: Improper Authentication
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A secon
- 7.5 High severity
PgBouncer: Uncontrolled Resource Consumption
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list looku
- 7.5 High severity
PgBouncer: Integer Overflow or Wraparound
Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to termin
- 7.5 High severity
PgBouncer: NULL Pointer Dereference
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required val
- 9.8 Critical severity
PgBouncer: Stack-based Buffer Overflow
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack over
- 7.5 High severity
PgBouncer: Integer Overflow or Wraparound
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
- 8.1 High severity
PgBouncer: Untrusted Search Path
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
- 9.8 Critical severity
PgBouncer: Use of a Key Past its Expiration Date
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password