CVE-2026-107349

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in PgBouncer via StartupMessage Processing

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: PostgreSQL

Description

An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107349

EUVD

EUVD-2026-101499

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	PgBouncer	1.20.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is an infinite loop in PgBouncer versions 1.20.0 through 1.26.0. An unauthenticated remote attacker can send a specially crafted StartupMessage with an empty parameter name in the options field, such as '-c='. This causes the ignore_startup_parameters list lookup to loop indefinitely, consuming a CPU core and making PgBouncer unresponsive to all clients until restarted.

Detection Guidance

Monitor PgBouncer process CPU usage for sustained 100% utilization on a core. Check logs for repeated StartupMessage errors with malformed options like '-c='. Use 'pgbouncer -v' to verify version 1.20.0 to 1.26.0. Network detection may involve inspecting PostgreSQL client connections for unusual parameter formats.

Impact Analysis

This vulnerability can cause a denial of service by saturating a CPU core, making PgBouncer unresponsive to all clients. This disrupts database connectivity and may lead to service outages for applications relying on PgBouncer.

Compliance Impact

This vulnerability causes a denial of service by saturating a CPU core, making PgBouncer unresponsive. This could lead to prolonged downtime for database connections, potentially violating availability requirements in GDPR and HIPAA, which mandate timely access to personal health or user data.

Mitigation Strategies

Upgrade PgBouncer to version 1.26.1 or later which fixes the infinite loop issue. If immediate upgrade is not possible, restrict network access to PgBouncer using firewalls or disable unauthenticated remote connections. Monitor CPU usage and restart the service if unresponsive.

Hi! I’m here to help you understand CVE-2026-107349. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70