Request a Demo
Home   >   mailing lists

PgBouncer 1.26.0 released - Fixes three CVEs - Mailing list pgsql-announce

From PgBouncer via PostgreSQL Announce
Subject PgBouncer 1.26.0 released - Fixes three CVEs
Date
Msg-id 179017107644.1026195.8202537946345239884@wrigleys.postgresql.org
Whole thread
List pgsql-announce
Tree view
 

PgBouncer 1.26.0 released - Fixes three CVEs

PgBouncer 1.26.0 has been released. This release fixes three CVEs:

  1. CVE-2026-19888: DoS due to crash, triggerable by unauthenticated clients. Caused by a SCRAM client-final-message without a nonce.
  2. CVE-2026-6668: DoS due to infinite loop, triggerable by unauthenticated clients. Caused by an integer overflow in the packet buffer growth logic.
  3. CVE-2026-6669: DoS due to unbounded work during login, triggerable by a malicious PostgreSQL server. Caused by an unbounded SCRAM iteration count.

It also tracks search_path and default_transaction_read_only by default, adds the pool_idle_timeout setting, allows query_wait_timeout to be set per user and database, adds meson build support, and removes the deprecated online restart (-R) functionality.

See https://www.pgbouncer.org/2026/09/pgbouncer-1-26-0 for more information, the detailed changelog, and download links.

PgBouncer is a lightweight connection pooler for PostgreSQL.

This email was sent to you from PgBouncer. It was delivered on their behalf by the PostgreSQL project. Any questions about the content of the message should be sent to PgBouncer.

You were sent this email as a subscriber of the pgsql-announce mailinglist, for the content tag Related Open Source. To unsubscribe from further emails, or change which emails you want to receive, please click the personal unsubscribe link that you can find in the headers of this email, or visit https://lists.postgresql.org/unsubscribe/.
 

pgsql-announce by date:

Previous
From: EMS Software Development via PostgreSQL Announce
Date:
Subject: SQL Manager for PostgreSQL 7.0: meet the AI Assistant
Next
From: PostgreSQL Global Development Group
Date:
Subject: PostgreSQL 19 Beta 4 Released!