The PgBouncer team has released version 1.26.0, a critical update that fixes three security vulnerabilities (CVEs) and brings several enhancements. PgBouncer is a lightweight connection pooler for PostgreSQL, widely used to manage database connections efficiently. The CVEs are all denial-of-service (DoS) issues, two triggerable by unauthenticated clients and one by a malicious server, making this upgrade essential for production deployments.
- CVE-2026-19888: DoS due to crash, triggerable by unauthenticated clients. Caused by a SCRAM client-final-message without a nonce.
- CVE-2026-6668: DoS due to infinite loop, triggerable by unauthenticated clients. Caused by an integer overflow in the packet buffer growth logic.
- CVE-2026-6669: DoS due to unbounded work during login, triggerable by a malicious PostgreSQL server. Caused by an unbounded SCRAM iteration count.
- Now tracks
search_pathanddefault_transaction_read_onlyby default. - Adds the
pool_idle_timeoutsetting. - Allows
query_wait_timeoutto be set per user and database. - Adds meson build support.
- Removes the deprecated online restart (
-R) functionality.
Developers should prioritize upgrading to 1.26.0 to mitigate the risk of DoS attacks, especially in environments where PgBouncer is exposed to untrusted networks. The new features, such as tracking search_path and default_transaction_read_only, improve session consistency, while the pool_idle_timeout setting and per-user/database query_wait_timeout provide finer control over connection pooling. The addition of meson build support modernizes the build system, and the removal of the deprecated -R flag encourages adoption of newer restart methods. Overall, this release enhances both security and operational flexibility for PostgreSQL deployments.
Source: https://www.postgresql.org/about/news/pgbouncer-1260-released-fixes-three-cves-3385/