EUVD-2026-101498
GHSA-982p-g5h4-w372
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PgBouncer listener (pre-auth on 1.23.0+)
-
ExploitSend five-byte header declaring length >2^31
-
ExecutionTrigger integer overflow in mbuf_make_room
-
ImpactNon-terminating growth loop pins CPU and stalls all pooled connections
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires PgBouncer to be running with max_packet_size configured above 2147483648 (2^31); this is NON-default (the shipped default is 2147483647), so default deployments are not exploitable. When that condition holds, versions 1.23.0 through 1.26.0 are reachable BEFORE authentication using just a five-byte packet header declaring a length above 2^31; earlier versions 1.21.0-1.22.x are affected but require reaching the vulnerable code path. The primary limiting factor is the non-default configuration - the single required setting gates the entire vulnerability; no user interaction, credentials, or special platform are needed once it is set. |
| Impact | Signals point to a genuine but conditional availability risk rather than a top-tier priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 5.9 Medium: network-reachable and unauthenticated (PR:N), but high attack complexity (AC:H) because exploitation only works when an administrator has set max_packet_size above 2147483648 - a non-default value (the default is 2147483647). Impact is availability-only (C:N/I:N) but complete for the affected service (A:H), since PgBouncer's single-process model means one pinned CPU core stalls every pooled connection. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no POC was provided, so exploitation status is 'no public exploit identified at time of analysis'. The AC:H is driven entirely by the required non-default configuration, not by any technical difficulty in crafting the packet - once that config is present, a five-byte header reliably triggers the overflow (pre-authentication on 1.23.0+). Net: a real priority ONLY for deployments that have raised max_packet_size above 2^31; for the overwhelming majority running defaults, real-world risk is low. |
| Exploit ScenarioDerived | In a PostgreSQL environment where PgBouncer has max_packet_size configured above 2147483648, a remote attacker connects to the pooler's listening port and sends a packet whose header declares a length above 2^31. The resulting integer overflow in mbuf_make_room leaves the buffer-growth loop unable to terminate, pinning a CPU core and freezing all pooled client connections until the process is restarted. On versions 1.23.0 through 1.26.0 this is reachable before authentication with only a five-byte packet header; no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in PgBouncer 1.21.0 through 1.26.0: a remote attacker who sends a packet header declaring a length above 2^31 triggers an integer overflow in the message buffer growth routine (mbuf_make_room), saturating a CPU core and stalling every pooled connection until the process is restarted. The attack is gated by a non-default configuration - max_packet_size must be set above 2147483648, whereas the shipped default of 2147483647 is not exploitable - but when that setting is in place, versions 1.23.0 through 1.26.0 are reachable before authentication with only a five-byte packet header (PR:N in the assessed vector), while 1.21.0-1.22.x require reaching the vulnerable code path. No public exploit identified at time of analysis, and a vendor patch is available (fixed in 1.26.1 per the EUVD affected-version range).
RemediationAI
Vendor-released patch: 1.26.1 (the EUVD affected range ends at 1.26.1), so the primary action is to upgrade PgBouncer to 1.26.1 or later and restart the pooler process; consult the changelog at https://www.pgbouncer.org/changelog.html for the exact release notes. If an immediate upgrade is not possible, the vulnerability can be neutralized by setting max_packet_size back to the shipped default of 2147483647 or any value at or below 2^31, which removes the overflow condition entirely - the trade-off is that this caps the largest accepted protocol packet and may reject workloads that were deliberately raising the limit to accommodate unusually large queries, so validate such clients before applying. Where the elevated max_packet_size must be retained, restrict network reachability of the PgBouncer listener (default port 6432) to trusted application hosts with firewall or host-based ACLs, since the pre-authentication trigger means credentials and TLS client checks do not stop it; this is a compensating control only and does not remove the bug. Note that once the spin is triggered the process will not recover on its own, so monitoring for CPU saturation and having an automated restart path limits the duration of an outage; patch remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PgBouncer is a lightweight PostgreSQL connection pooler that serves all clients and server connections from a single process. Its wire-protocol handling uses an mbuf message buffer whose growth path, mbuf_make_room, computes the required buffer size before reallocating; when max_packet_size is configured above 2^31 (2147483648), a packet header declaring a length above that threshold makes the size computation overflow (CWE-190, integer overflow), so the growth loop's termination condition can never be satisfied and the process spins. Because the pooler is single-process, this saturates one CPU core and blocks every pooled connection, requiring a process restart to recover - an availability-only impact (C:N/I:N/A:H) matching the assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U. The AC:H rating reflects the non-default configuration prerequisite rather than any attack complexity. From 1.23.0 onward the vulnerable path is reachable during the pre-authentication packet header parse, so no credentials are needed once max_packet_size exceeds the threshold. The provided CPE string cpe:2.3:a:n/a:pgbouncer (corresponding to the PgBouncer project) and ENISA EUVD-2026-101498 both map the issue to PgBouncer versions below 1.26.1.
Know when Pgbouncer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because it depends on the non-default max_packet_size>2^31 setting; availability-only total impact (A:H, C/I:N).
Primary rating from Vendor (PostgreSQL).
CVSS VectorVendor: PostgreSQL
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by send
Stack-based buffer overflow in PgBouncer before 1.25.2 lets a malicious or impersonated PostgreSQL backend corrupt the p
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Se
Authentication bypass in PgBouncer 1.17.0 through 1.26.0 allows an authenticated attacker who knows a valid password for
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value,
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries
Unauthenticated remote attackers can render PgBouncer 1.20.0 through 1.26.0 unresponsive by sending a single crafted Sta
A crafted oversized input to the PgBouncer connection pooler (versions through 1.25.2) triggers an integer overflow in p
Unauthenticated remote attackers can crash PgBouncer through 1.25.2 by sending a malformed SCRAM client-final-message th
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to
Remote denial-of-service in PgBouncer versions before 1.25.2 allows unauthenticated attackers to crash the connection po
Exploit-DB