Debian Package Tracker
Register | Log in
Subscribe

pgbouncer

lightweight connection pooler for PostgreSQL

Choose email to subscribe with

general
  • source: pgbouncer (main)
  • version: 1.25.1-1
  • maintainer: Debian PostgreSQL Maintainers (DMD)
  • uploaders: Peter Eisentraut [DMD] – Christoph Berg [DMD] – Marco Nenciarini [DMD]
  • arch: any
  • std-ver: 4.7.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 1.15.0-1
  • o-o-sec: 1.15.0-1+deb11u1
  • oldstable: 1.18.0-1
  • stable: 1.24.1-1
  • testing: 1.25.0-2
  • unstable: 1.25.1-1
versioned links
  • 1.15.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.15.0-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.18.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.24.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.25.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.25.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • pgbouncer
action needed
2 security issues in bookworm high

There are 2 open security issues in bookworm.

1 important issue:
  • CVE-2025-12819: Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
1 issue left for the package maintainer to handle:
  • CVE-2025-2291: (needs triaging) Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-04-17 Last update: 2025-12-04 08:30
1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:
  • CVE-2025-12819: Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
Created: 2025-12-04 Last update: 2025-12-04 08:30
1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:
  • CVE-2025-12819: Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
Created: 2025-12-04 Last update: 2025-12-04 08:30
1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:
  • CVE-2025-12819: Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
Created: 2025-12-04 Last update: 2025-12-04 08:30
Fails to build during reproducibility testing normal
A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!
Created: 2025-11-24 Last update: 2025-12-04 09:31
lintian reports 1 warning normal
Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.
Created: 2025-12-04 Last update: 2025-12-04 03:01
debian/patches: 3 patches to forward upstream low

Among the 3 debian patches available in version 1.25.1-1 of the package, we noticed the following issues:

  • 3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2025-12-04 08:00
testing migrations
  • excuses:
    • Migration status for pgbouncer (1.25.0-2 to 1.25.1-1): BLOCKED: Maybe temporary, maybe blocked but Britney is missing information (check below)
    • Issues preventing migration:
    • ∙ ∙ Missing build on riscv64
    • ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
    • ∙ ∙ Autopkgtest for pgbouncer/1.25.1-1: amd64: Test triggered, arm64: Pass, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for python-pgbouncer/0.1.0-1: amd64: Test triggered, arm64: Pass, ppc64el: Test triggered, s390x: Test triggered
    • ∙ ∙ Lintian check waiting for test results on riscv64 - info
    • ∙ ∙ Too young, only 0 of 5 days old
    • Additional info (not blocking):
    • ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/p/pgbouncer.html
    • ∙ ∙ Waiting for reproducibility test results on arm64 - info ♻
    • Not considered
news
[rss feed]
  • [2025-12-03] Accepted pgbouncer 1.25.1-1 (source) into unstable (Christoph Berg)
  • [2025-11-24] pgbouncer 1.25.0-2 MIGRATED to testing (Debian testing watch)
  • [2025-11-21] Accepted pgbouncer 1.25.0-2 (source) into unstable (Christoph Berg)
  • [2025-11-12] Accepted pgbouncer 1.25.0-1 (source) into unstable (Christoph Berg)
  • [2025-05-26] Accepted pgbouncer 1.15.0-1+deb11u1 (source) into oldstable-security (Andreas Henriksson)
  • [2025-04-27] pgbouncer 1.24.1-1 MIGRATED to testing (Debian testing watch)
  • [2025-04-17] Accepted pgbouncer 1.24.1-1 (source) into unstable (Christoph Berg)
  • [2025-03-26] pgbouncer 1.24.0-3 MIGRATED to testing (Debian testing watch)
  • [2025-03-12] Accepted pgbouncer 1.24.0-3 (source) into unstable (Christoph Berg)
  • [2025-03-12] Accepted pgbouncer 1.24.0-2 (source) into unstable (Christoph Berg)
  • [2024-08-05] pgbouncer 1.23.1-1 MIGRATED to testing (Debian testing watch)
  • [2024-08-03] Accepted pgbouncer 1.23.1-1 (source) into unstable (Bradford D. Boyle) (signed by: Christoph Berg)
  • [2024-07-06] pgbouncer 1.23.0-1 MIGRATED to testing (Debian testing watch)
  • [2024-07-04] Accepted pgbouncer 1.23.0-1 (source) into unstable (Bradford D. Boyle) (signed by: Christoph Berg)
  • [2024-04-26] pgbouncer 1.22.1-1 MIGRATED to testing (Debian testing watch)
  • [2024-04-26] pgbouncer 1.22.1-1 MIGRATED to testing (Debian testing watch)
  • [2024-04-17] Accepted pgbouncer 1.22.1-1 (source) into unstable (Christoph Berg)
  • [2024-02-13] pgbouncer 1.22.0-1 MIGRATED to testing (Debian testing watch)
  • [2024-02-09] Accepted pgbouncer 1.22.0-1 (source) into unstable (Christoph Berg)
  • [2023-10-19] pgbouncer 1.21.0-1 MIGRATED to testing (Debian testing watch)
  • [2023-10-17] Accepted pgbouncer 1.21.0-1 (source) into unstable (Christoph Berg)
  • [2023-09-29] pgbouncer 1.20.1-1 MIGRATED to testing (Debian testing watch)
  • [2023-09-27] Accepted pgbouncer 1.20.1-1 (source) into unstable (Bradford D. Boyle) (signed by: Christoph Berg)
  • [2023-07-28] pgbouncer 1.20.0-1 MIGRATED to testing (Debian testing watch)
  • [2023-07-28] pgbouncer 1.20.0-1 MIGRATED to testing (Debian testing watch)
  • [2023-07-25] Accepted pgbouncer 1.20.0-1 (source) into unstable (Christoph Berg)
  • [2023-06-04] Accepted pgbouncer 1.19.1-1 (source) into experimental (Christoph Berg)
  • [2023-05-22] Accepted pgbouncer 1.19.0-1 (source) into experimental (Christoph Berg)
  • [2023-02-06] pgbouncer 1.18.0-1 MIGRATED to testing (Debian testing watch)
  • [2023-02-03] Accepted pgbouncer 1.18.0-1 (source) into unstable (Michael Banck)
  • 1
  • 2
bugs [bug history graph]
  • all: 0
links
  • homepage
  • lintian (0, 1)
  • buildd: logs, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 1.25.0-2
  • 4 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing