EUVD-2026-101499
GHSA-h8cj-p2h5-hm79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to PgBouncer listening port
-
ExploitSend StartupMessage with empty parameter name
-
ExecutionTrigger infinite loop in ignore_startup_parameters lookup
-
ImpactSaturate CPU core, deny all pooled clients
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - a remote unauthenticated attacker triggers it against default configurations of PgBouncer versions 1.20.0 through 1.26.0 by sending a single StartupMessage whose options parameter contains an empty parameter name (e.g. "-c="). The malicious message is processed during the startup/parameter-ignore handling phase before client authentication, so no credentials, TLS client auth, or prior session are needed. Limiting factors: only PgBouncer releases 1.20.0-1.26.0 are affected; the attacker must have TCP reachability to the PgBouncer listening port, so deployments that restrict PgBouncer to a trusted internal application tier (not internet-exposed) materially reduce exposure. Impact is limited to availability - no data disclosure or code execution - and recovery requires a manual PgBouncer process restart. |
| Impact | All available CVSS signals agree this is a straightforward, high-severity availability flaw: AV:N/AC:L/PR:N/UI:N means a remote, unauthenticated attacker can trigger it over the network with low complexity and no user interaction, and A:H with C:N/I:N confirms the sole impact is denial of service - no data exposure or code execution. The CVE description is fully consistent with the CVSS vector (the malicious StartupMessage is processed before authentication, which justifies PR:N), so there is no network-vs-local or auth conflict to reconcile. Severity is amplified beyond the 7.5 score by PgBouncer's single-process architecture: one crafted message saturates a CPU core and denies service to ALL pooled clients until a manual restart, making this effectively a full-outage primitive for any affected instance. However, key exploitation-likelihood signals are MISSING from the input: no EPSS score, no CISA KEV listing, and no POC indicator were provided, so real-world exploitation probability cannot be quantified from this data. Exploitation status is therefore 'no public exploit identified at time of analysis.' Net assessment: a genuine, easy-to-weaponize DoS that is a real priority for any PgBouncer instance reachable by untrusted clients, but lower urgency where PgBouncer is correctly restricted to trusted application tiers rather than exposed to the internet. |
| Exploit ScenarioDerived | No public exploit was identified at time of analysis. An attacker who can reach the PgBouncer listening port opens a connection and sends a PostgreSQL StartupMessage whose options parameter contains an empty parameter name (e.g. "-c="), causing the ignore_startup_parameters list lookup to loop forever. Because the attack requires no authentication, no user interaction, and only a single low-complexity network message (AV:N/AC:L/PR:N/UI:N), one request pins a CPU core and renders PgBouncer unresponsive to all clients until it is restarted. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Unauthenticated remote attackers can render PgBouncer 1.20.0 through 1.26.0 unresponsive by sending a single crafted StartupMessage whose options parameter contains an empty parameter name (for example "-c="), which makes the server's ignore_startup_parameters lookup loop indefinitely during the pre-authentication startup phase. Because PgBouncer serves every client from a single process, the loop pins a CPU core and stalls all connection pools until an administrator manually restarts the daemon, so a lone packet from any TCP-reachable source can take down the entire pooler. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the issue is network-reachable with low complexity, requires no credentials or user interaction, and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting its availability-only impact.
RemediationAI
Upgrade PgBouncer beyond the affected 1.20.0-1.26.0 range to the fixed release documented in the upstream changelog (https://www.pgbouncer.org/changelog.html), which is the primary and definitive remediation; consult that changelog to confirm the precise patched version for your branch before upgrading, and restart the daemon after installing so the fix takes effect. Until patching is possible, apply network-level compensating controls: restrict TCP access to the PgBouncer listening port (commonly 6432) with host firewalls, security groups, or nftables/iptables rules so that only trusted application-tier hosts can open connections, since the trigger requires only TCP reachability and no credentials - the trade-off is that legitimate clients outside those allowlists are blocked and must be re-homed. Exposing PgBouncer directly to the internet or to broad internal subnets should be treated as unacceptable for these versions, and PgBouncer should never be placed in front of a public PostgreSQL endpoint during the exposure window. Note that the flaw sits inside ignore_startup_parameters handling, so tuning or emptying that setting is not a reliable workaround; a compromised or runaway instance can only be recovered by manually restarting the PgBouncer process, which drops all pooled connections and briefly interrupts database access for every client, so operators should plan for rapid restart capability and monitor for CPU saturation of the PgBouncer process as an indicator of exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PgBouncer is a lightweight, single-process PostgreSQL connection pooler: one daemon multiplexes connections for all clients, which is precisely why a per-connection defect degrades the whole service. The vulnerability is an instance of CWE-835 (Loop with Unreachable Exit Condition / infinite loop) occurring in the startup message parsing path. When a client sends a PostgreSQL StartupMessage, PgBouncer inspects its options parameter and compares each parameter name against the configured ignore_startup_parameters list. An option token with an empty parameter name such as "-c=" produces a zero-length name that the comparison/iteration logic never advances past, so the list lookup never terminates. This code path runs during connection startup before authentication, meaning the malformed message is consumed by the pooler itself regardless of whether the client ever supplies valid credentials or completes TLS/authentication negotiation. The supplied CPE is generic (cpe:2.3:a:n/a:pgbouncer), consistent with the upstream project not mapping to a distinct vendor namespace, and the root cause is bounded to the ignore_startup_parameters processing introduced/affected across releases 1.20.0 through 1.26.0.
Know when Pgbouncer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Pre-auth StartupMessage parsing gives AV:N/PR:N/UI:N/AC:L; single-process hang is pure availability loss (A:H) with no confidentiality or integrity impact and no scope change.
Primary rating from Vendor (PostgreSQL).
CVSS VectorVendor: PostgreSQL
Lifecycle Timeline
2DescriptionCVE.org
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
Executive ViewAI
A single unauthenticated network packet can knock out PgBouncer versions 1.20.0 through 1.26.0, the connection pooler sitting in front of most PostgreSQL deployments, causing complete loss of database connectivity for every dependent application until an administrator manually restarts the daemon. Because the flaw is triggered before authentication and affects the entire pooler process rather than a single session, any host with TCP reachability to the PgBouncer port can cause an outage, making this a broad availability risk to customer-facing and internal services alike. No vendor patch is currently available and no public exploit code has been identified at time of analysis (no public exploit identified at time of analysis), so leadership should expect exposure to persist until compensating network controls are in place.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict network ACLs/security groups so only trusted application hosts can reach the PgBouncer listener (never internet-exposed); rate-limit or throttle new TCP connections at the load balancer or firewall; monitor CPU utilization and pool health with automated alerting and daemon auto-restart; and reduce reliance on the pooler for critical paths where feasible. These controls reduce exposure but do not remediate the underlying flaw.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by send
Stack-based buffer overflow in PgBouncer before 1.25.2 lets a malicious or impersonated PostgreSQL backend corrupt the p
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Se
Authentication bypass in PgBouncer 1.17.0 through 1.26.0 allows an authenticated attacker who knows a valid password for
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value,
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries
A crafted oversized input to the PgBouncer connection pooler (versions through 1.25.2) triggers an integer overflow in p
Unauthenticated remote attackers can crash PgBouncer through 1.25.2 by sending a malformed SCRAM client-final-message th
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to
Remote denial-of-service in PgBouncer versions before 1.25.2 allows unauthenticated attackers to crash the connection po
Denial of service in PgBouncer before 1.25.2 lets a malicious or malfunctioning PostgreSQL backend crash the connection
Exploit-DB