Posted on 2026-09-23T00:00:00Z · PgBouncer · PostgreSQL News
PgBouncer 1.26.0 has been released. This release fixes three CVEs:
- CVE-2026-19888: DoS due to crash, triggerable by unauthenticated clients. Caused by a SCRAM client-final-message without a nonce.
- CVE-2026-6668: DoS due to infinite loop, triggerable by unauthenticated clients. Caused by an integer overflow in the packet buffer growth logic.
- CVE-2026-6669: DoS due to unbounded work during login, triggerable by a malicious PostgreSQL server. Caused by an unbounded SCRAM iteration count.
It also tracks search_path and default_transaction_read_only by default, adds the pool_idle_timeout setting, allows query_wait_timeout to be set per user and database, adds meson build support, and removes the deprecated online restart (-R) functionality.
See https://www.pgbouncer.org/2026/09/pgbouncer-1-26-0 for more information, the detailed changelog, and download links.
PgBouncer is a lightweight connection pooler for PostgreSQL.
Source records
- center.news_newsarticle · 3385 · 2026-10-03T04:08:35.169032Z
- headline:upstream-news · https://www.postgresql.org/about/news/pgbouncer-1260-released-fixes-three-cves-3385/ · 2026-10-01T05:35:38.846352Z
- official:news · n3385 · 2026-10-03T04:37:45.370336Z
- pgweb.news_newsarticle · 3385 · 2026-10-03T04:08:55.967155Z