-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 14 Oct 2026 12:55:24 +0200
Source: pgbouncer
Architecture: source
Version: 1.26.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PostgreSQL Maintainers <team+postgresql@tracker.debian.org>
Changed-By: Christoph Berg <myon@debian.org>
Changes:
pgbouncer (1.26.1-1) unstable; urgency=medium
.
* New upstream version 1.26.1.
* Fix CVE-2026-107350: PgBouncer 1.17.0 through 1.26.0 processed a second
StartupMessage sent during SCRAM authentication when the client
connected to a non-existent database. An attacker knowing the password
of a user listed in `auth_file` could use this to log in as any other
user that authenticates using SCRAM, including admins and backend
superusers. This requires SCRAM authentication to be used for both
users. The impersonated user can come from either `auth_file` or
`auth_query`.
* Fix CVE-2026-107349: An unauthenticated client could make PgBouncer
1.20.0 through 1.26.0 spin forever on a CPU core, and thus stop serving
all clients, by sending a startup `options` parameter containing an
empty option name such as `-c=`. This is only exploitable when
`ignore_startup_parameters` is non-empty but does not contain `options`.
* Fix CVE-2026-107348: An integer overflow in the packet buffer growth
logic of PgBouncer 1.21.0 through 1.26.0 could cause PgBouncer to hang
in an infinite loop when a client sent a packet header declaring a
length above 2^31. This is only exploitable when `max_packet_size` is
set to 2147483649 or higher, the default of 2147483647 is not affected.
Since 1.23.0 this is reachable before authentication. This is the same
class of bug as CVE-2026-6668, but in a different buffer implementation.
Checksums-Sha1:
6bc0bae72fb5ebd5341edd45576f06339ad88012 2597 pgbouncer_1.26.1-1.dsc
8596c9267365ec26ba934a64c7403aa3f8cd24d7 898647 pgbouncer_1.26.1.orig.tar.gz
21300e9cef9893aa510a781f184feebda3a59e86 16076 pgbouncer_1.26.1-1.debian.tar.xz
Checksums-Sha256:
9912a523c6776ad7ceb2a9feac5c42e3e7c00123b973a5459cad803888f56c6a 2597 pgbouncer_1.26.1-1.dsc
00886a2994b4844cd37110970df777772cfc42a74c400522c82fba509a3f42d9 898647 pgbouncer_1.26.1.orig.tar.gz
66b4605556ce8b41ee2d45b0f4a3a9b5ec663c364dcedf6472b8dc65bb916ad0 16076 pgbouncer_1.26.1-1.debian.tar.xz
Files:
b69cb754b6a15e67fb791f7e4691a3ae 2597 database optional pgbouncer_1.26.1-1.dsc
aaa5fd3a4b7c20b9a1086bb8be507d7a 898647 database optional pgbouncer_1.26.1.orig.tar.gz
4937f06b1c79699f0996a53a8c726934 16076 database optional pgbouncer_1.26.1-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXEj+YVf0kXlZcIfGTFprqxLSp64FAmrPYWMACgkQTFprqxLS
p65cdBAAmvwZKHbA12B+80SA1cw5BRK2MgPQs0Ciz/FQxkSShlmYYjTtTBEz/uxL
Ynu65oLmzQyRYTxbE3JpZyU9iDukOsrkT0Nm7Zq4NRzJlyG4Xfn8pavC6VYOtcjf
Pkkscl9D0eYTWSfoaSw/XrqCE3qoaCJQW28adnUELldSP32aVayhXS+32tG4jYuY
zpcbm+wuAIqaHyrAHDD30MaEh/taid8XDLDDxblyHBLNESWdKrImvjpBu+6AQQUQ
vaZKXlSmBSevmRfc53KlcmL6Q8BuC/xFdVeyAfn8tLJctDvuhk12p46AOfq3go+L
Nkz1u3ic5K9QL2KC69JToAQ1sNPyphlIWZJVbQBPqvOCX2t0eeaoqZsaiE5icXYT
Dn9EGiTjajAB3IX16m1Xkn9pmy/FVE1UO4Pwtd5sd9k3W1dXsJqIXtVdeu30kYJy
BKZsfiCPvM0SopobGWVI2vl2pqQf5yHnFNUNVdvMXCT08oyljeCdwTiZ9tnWX1WV
qnD9KlyNt/I1zcgY/K9Cvds0ev/B5EDC7396C5jE7mwUrLR0lstgWoNB4SIya+rf
xb66JYIgWqYtwsum3R2IpSSc/OxdUApihfUIJiouTFrXeuPwixONn8xTbT9phiup
2PhVOeyE+8V/IlyoR36CCsm3ajbrmU6NJ+wbOjH5LXJuGnt7blI=
=/6B3
-----END PGP SIGNATURE-----
