CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service.
Published Oct 14, 2026 · updated Oct 14, 2026
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · OSV.dev
Detected
Oct 14, 2026 · OSV.dev
Updated
The description or metadata changed.
Oct 14, 2026 · NIST NVD
Updated
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to al
Affected
- Debian:12 pgbouncer1.18.0-1, 1.18.0-1+deb12u1, 1.19.0-1
- Debian:13 pgbouncer1.24.1-1, 1.24.1-1+deb13u1, 1.24.1-1+deb13u2
- Debian:14 pgbouncer1.24.1-1, 1.25.0-1, 1.25.0-2
Sources
- CVE.orgCVE-2026-107349
Official CVE identifier
cve.org - NIST NVDCVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Beca
nvd.nist.gov - OSV.devDEBIAN-CVE-2026-107349osv.dev