PgBouncer 1.26.1 fixes one SCRAM authentication bypass and two denial-of-service vulnerabilities. The release also restores the expected behavior of the ignore_startup_parameters setting.
PgBouncer 1.26.1 was released on October 14 as a security and bug-fix update for the PostgreSQL connection pooler. The release addresses three CVEs affecting versions up to 1.26.0, though each issue has specific conditions. (official release notes)
The most serious issue, CVE-2026-107350, could let an attacker log in as another SCRAM-authenticated user—including an administrator or PostgreSQL superuser. Exploitation required the attacker to know the password of a different SCRAM user listed in auth_file, and both accounts had to use SCRAM authentication. The flaw affected PgBouncer 1.17.0 through 1.26.0.
The other two vulnerabilities could cause PgBouncer to enter an infinite loop and stop serving clients. CVE-2026-107349 could be triggered by an unauthenticated client when ignore_startup_parameters was configured without options, and a startup packet contained an empty option name. It affected versions 1.20.0 through 1.26.0.
CVE-2026-107348 involved an integer overflow in packet-buffer growth. It affected versions 1.21.0 through 1.26.0, but only when max_packet_size was set to 2147483649 or higher; the default value is 2147483647. Since PgBouncer 1.23.0, the issue could be reached before authentication. (PgBouncer changelog)
The update also fixes a configuration regression introduced in 1.26.0. Because search_path became tracked by default, ignore_startup_parameters = search_path stopped working as expected. PgBouncer 1.26.1 gives ignore_startup_parameters precedence over tracked parameters, restoring the behavior from version 1.25.
PgBouncer 1.26.1 is available as a source tarball. Operators should review the vulnerability conditions and update their installations accordingly.
