Nobody Patches the Pooler

PgBouncer 1.26.0, released September 23, patches three CVEs, two of which can be triggered pre-authentication by anyone able to reach the listener over TCP. CVE-2026-19888 is a NULL pointer dereference in SCRAM parsing present since SCRAM support was added in 1.11.0 (August 2019); omitting the client-final-message's r= attribute crashes the process. CVE-2026-6668 is an integer overflow in packet buffer growth that causes PgBouncer to hang forever rather than crash, silently freezing every client since it is single-threaded. CVE-2026-6669 involves a malicious upstream PostgreSQL server advertising an excessive SCRAM iteration count; 1.26.0 now caps it at 1,000,000. Because PgBouncer crashing causes all clients to reconnect simultaneously, it can trigger the exact connection storm it exists to prevent. The post argues PgBouncer is neglected because it isn't part of the regular PostgreSQL minor-version upgrade cadence, and urges immediate upgrade, noting removal of the deprecated -R online restart, SHOW FDS, and SUSPEND, plus a fix stopping search_path and default_transaction_read_only from leaking between clients in transaction pooling mode.

Source: https://postgr.es/p/9wU. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.