-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 25 Sep 2026 10:41:27 +0200
Source: pgbouncer
Architecture: source
Version: 1.26.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PostgreSQL Maintainers <team+postgresql@tracker.debian.org>
Changed-By: Bradford D. Boyle <bradford.d.boyle@gmail.com>
Changes:
pgbouncer (1.26.0-1) unstable; urgency=medium
.
[ Bradford D. Boyle ]
* New upstream release.
- Security
* Fix CVE-2026-19888: PgBouncer before 1.26.0 did not check that the
SCRAM client-final-message contained a nonce. An unauthenticated
remote attacker could crash PgBouncer by sending a
client-final-message without one. This also applies to users that do
not exist, because PgBouncer runs a mock SCRAM exchange for those.
This bug has existed since SCRAM support was added in PgBouncer
1.11.0.
* Fix CVE-2026-6668: An integer overflow in the packet buffer growth
logic of PgBouncer before 1.26.0 could cause PgBouncer to hang in an
infinite loop. This required sending a large amount of data into a
single packet buffer, which is possible without authenticating first
when max_packet_size is left at its default value. Because PgBouncer
is single-threaded, this hang stopped it from serving any clients
until the process was killed.
* Fix CVE-2026-6669: PgBouncer before 1.26.0 did not bound the SCRAM
iteration count that it accepted from a server. A malicious or
compromised PostgreSQL server could make PgBouncer perform an
unbounded amount of work during a single login, stopping it from
serving all other clients and databases in the meantime. The iteration
count now has to be at most 1000000.
- Features
* Track all parameters that PostgreSQL reports by default. Most notably
this means that search_path (on PostgreSQL 18 and above) and
default_transaction_read_only (on PostgreSQL 14 and above) are now
tracked by default. Previously a client running SET search_path or SET
default_transaction_read_only = true in transaction pooling mode would
affect other clients that later used the same server connection.
(#1580, #1573)
* Add pool_idle_timeout setting to clean up pools that have not been
used for a while. This is useful in setups with many different users
that connect infrequently. Without this setting enabled the number of
pools grows without bound in such setups. The setting is disabled by
default, because removing a pool also loses its statistics. (#1491)
* Allow query_wait_timeout to be configured per user and per database.
(#1449)
* Add client_login_count stat to SHOW STATS, which counts successful
client logins. This makes it possible to detect clients that churn
connections. (#1457)
* Send PgBouncer specific ParameterStatus messages to clients on login:
pgbouncer.version, pgbouncer.pool_mode and
pgbouncer.max_prepared_statements. This allows clients and drivers to
detect that they are connected through PgBouncer and adapt their
behaviour accordingly. (#1490)
* Add login_notify_message setting. When set, its value is sent to
clients as a NOTICE message after they log in. This can be used to
make it clear to clients that they are connected through PgBouncer
instead of directly to PostgreSQL. (#1488)
* Add support for building PgBouncer with meson, including a Windows
build using the UCRT64 environment. Autoconf builds continue to be
supported. (#1524, #1426, #1568, #1585, #1602, #1607)
* Add a logo. (#1609)
- Changes
* Remove the deprecated online restart (-R, aka takeover) functionality,
together with the SHOW FDS and SUSPEND admin commands that only
existed to support it. Use rolling restarts with so_reuseport instead.
(#1581)
* Increase the maximum length of passwords to 65535 bytes, matching
libpq. (#1310, #1520)
* Treat a NULL user name returned by auth_query the same as no rows
being returned, instead of treating it as an error. (#1569)
* Accept SET extra_float_digits on the admin database, which newer
PostgreSQL JDBC drivers send during connection setup. (#1550)
* Allow mkauth.py to write to stdout by passing - as the output file.
(#1514)
* Stop logging noisy errors on unexpected EOF from clients when built
against OpenSSL 3. (#1507)
* Include the underlying system error in TLS error messages when built
against OpenSSL 3. (#1492)
* Require a C11 compiler. (#1417)
* Log which limit caused a server connection to be evicted. The
disconnect reason is now evicted for max_db_connections, evicted for
pool_size or evicted for max_user_connections instead of the bare
evicted. (#1597)
- Fixes
* Fix late COPY messages causing pool exhaustion in transaction pooling
mode. This also makes COPY work outside of an explicit transaction in
transaction pooling mode. (#1471)
* Fix LDAP authentication failures with long DNs by increasing the
maximum LDAP URL length. (#1497)
* Fix SCRAM pass-through corrupting the cached credentials of a forced
user, which caused server logins to fail with the real server
rejecting the SCRAM proof. (#1612)
* Fix SCRAM pass-through failing with stored SCRAM secrets after a
server reconnect, with the error "password is SCRAM secret but client
authentication did not provide SCRAM keys". (#1504, bug introduced in
1.25.1)
* Fix use-after-free crash when a replication client disconnects while
its server connection is still logging in. (#1577)
* Fix eviction of idle server connections for replication clients when
the pool is full. Previously a single replication client could evict
every idle server in the pool instead of just one, and no eviction
happened at all when the pool held more servers than pool_size because
of the reserve pool or cancel requests. (#1597)
* Fix stalled TLS connections when a packet straddles the packet buffer
boundary, for example a SET application_name with a long value.
(#1531)
* Fix prepared statement responses being sent in the wrong order when a
batch mixes Parse and Close messages without a Sync in between.
(#1555)
* Fix parameters listed in track_extra_parameters that are not reported
by the server causing incorrect behaviour when a client sets them in
its startup packet. (#1576)
* Fix login failures when the server splits its login packets across
multiple TCP packets, for example when there is another proxy between
PgBouncer and PostgreSQL. (#1446)
* Fix query_timeout closing connections when no query was in flight.
(#1395)
* Fix sending a duplicate NegotiateProtocolVersion message when no
server was available right away. (#1460)
* Fix pool_size column in SHOW USERS showing a value for users that do
not have one configured. (#1489)
* Fix error message for ENABLE admin command. (#1308)
* Fix compilation against future OpenSSL versions that make struct
asn1_string_st opaque. (#1440)
* Prevent the compiler from optimizing away the erasure of sensitive
cryptographic data from the stack. (#1508)
* Fix linking of pgbevent.dll with clang on Windows. (#1571)
* Fix paths of root-level files in the release tarball, which were
stored as pgbouncer-X.Y.Z/./configure instead of
pgbouncer-X.Y.Z/configure. (#1549)
* Fix a memory leak when reading track_extra_parameters from the config.
(#1510)
* Fix a memory leak for every startup packet that contained a protocol
extension parameter (_pq_. prefix), which could be triggered by
unauthenticated clients. (#1540)
.
[ Brian Cosgrove ]
* Replace the removed online restart option in the SysV init script with
stop/start and document the change in NEWS.
* Remove online restart from the package description.
* Test connections after restart in autopkgtest.
* Convert debian/copyright to machine-readable format.
Checksums-Sha1:
cf05f07f44fd5a252131a5db36687b65ca63c85c 2597 pgbouncer_1.26.0-1.dsc
234dfd6f13c7ef83fafb853e8417759e4a37b72e 897943 pgbouncer_1.26.0.orig.tar.gz
40352aefc7cb648e6a166be3e1bf21e52db13f99 15032 pgbouncer_1.26.0-1.debian.tar.xz
Checksums-Sha256:
03bae8a07b4983040c256515f8684b91ab8945d5a2f93f5709174115293c10a9 2597 pgbouncer_1.26.0-1.dsc
afd25dd61ee6775d37b40629b87ce08736b3e6955f3057bb212e410fbf21c71d 897943 pgbouncer_1.26.0.orig.tar.gz
fb789e9baf87c2e155e23e5c906d990d85094494f4e15cfda3186fc59e8feb78 15032 pgbouncer_1.26.0-1.debian.tar.xz
Files:
72354652c29e4a314bf4ecc68c9db091 2597 database optional pgbouncer_1.26.0-1.dsc
b07faa3f30c6bd03c6c62f398f535038 897943 database optional pgbouncer_1.26.0.orig.tar.gz
68a68b4f5d2dae8e1fb6820698eeb18b 15032 database optional pgbouncer_1.26.0-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXEj+YVf0kXlZcIfGTFprqxLSp64FAmq6X20ACgkQTFprqxLS
p64wtQ/+Ov0WXsE0g+CFplZwV+xoG8iupOpoaKOzkoV3U0Ee+e7KSc4hIe4J5VaE
V8n8oZX8JE++C6yNuNRvDSGh4F+OXBCIMAOwHTg6lGj/BAfV436ITFwK7jLRgDiy
9rQ7dWSNWNH2ZWuGDsgxSOGeTDiV5S7bQTkKvGcHVXSsx8ytgV1Luk1BuOFfoAz5
fDvPhBK9erkcKBkbthEHqUHMZOWr1Vx1M3ANfpRhOEmIS3oks7J3U3mTJLck35Xs
w+oTUPvZ+tZ2JkNeAnOxRtlonWF8uYEqNPNGVNYFEumkXMuHy1si1KnMIhglE8Vd
/5B/K4VOBiK/EBQqaLjM582UdFXlIcxUPm7ORzEjYp+1XAeP1E+HlWx8k+7OZ5is
SJgLcVFiccVjgrt6U7qMXQuygqJiH2dPiRgLyn5lYLOYajZXuQNwdbbrGgN7LKes
z7RCBiHVAJgczPXwpalPrIXkntsqYPsB8CddRif/Y9Ia9Vw+1hKYHuiQYrWzvNzY
hH6eZF3ZW5kF+4+TlTRfh1KKUhHJX81areJImX1yOqWZO+2C3or99TdNiWIUji4q
MXCWKOsmoOtv2J9h0irR6SU6XsfFMtDQoXsTLU7JRcXMvtiqXANRXAoyT9kv49j5
nYj0PKQCuoZmK6QsdWoMAA44IU561E+P0xfQKBjflKLS/Nz7RYw=
=ss6v
-----END PGP SIGNATURE-----
