CVE-2026-107349
Infinite loop on empty option name in startup options parameter in PgBouncer
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Infinite loop on empty option name in startup options parameter in PgBouncer
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
- Record
CVE-2026-107349- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835, CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-101499
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
- Record
EUVD-2026-101499- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h8cj-p2h5-hm79
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to...
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
- Record
GHSA-h8cj-p2h5-hm79- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
- Record
CVE-2026-107349- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-835
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
- Record
DEBIAN-CVE-2026-107349- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:83843
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:83843- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
- Record
UBUNTU-CVE-2026-107349- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-108192 No score
CVE-2026-107349 affecting package pgbouncer for versions less than 1.26.1-1
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
- Record
AZL-108192- Updated
- 2026-11-02
OSVBIT-pgbouncer-2026-107349 No score
Infinite loop on empty option name in startup options parameter in PgBouncer
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
- Record
BIT-pgbouncer-2026-107349- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pgbouncerAzure Linux:3 |
before 1.26.1-1 | 1.26.1-1 |
pgbouncerBitnami |
1.20.0 up to 1.26.1 | 1.26.1 |
pgbouncerDebian:12 |
All versions, plus listed versions 1.18.0-11.18.0-1+deb12u11.19.0-11.19.1-11.20.0-1 Show 20 moreShow less1.20.1-11.21.0-11.22.0-11.22.1-11.23.0-11.23.1-11.24.0-21.24.0-31.24.1-11.25.0-11.25.0-21.25.1-11.25.2-11.26.0-11.26.0-21.26.0-31.26.0-41.26.0-51.26.0-61.26.1-1 |
None known |
pgbouncerDebian:13 |
All versions, plus listed versions 1.24.1-11.24.1-1+deb13u11.24.1-1+deb13u21.25.0-11.25.0-2 Show 9 moreShow less1.25.1-11.25.2-11.26.0-11.26.0-21.26.0-31.26.0-41.26.0-51.26.0-61.26.1-1 |
None known |
pgbouncerDebian:14 |
before 1.26.1-1, plus listed versions 1.24.1-11.25.0-11.25.0-21.25.1-11.25.2-1 Show 6 moreShow less1.26.0-11.26.0-21.26.0-31.26.0-41.26.0-51.26.0-6 |
1.26.1-1 |
pgbouncerRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.26.1-1.hum1 | 0:1.26.1-1.hum1 |
pgbouncerUbuntu:16.04:LTS |
All versions, plus listed versions 1.5.5-11.6.1-11.7-1 |
None known |
pgbouncerUbuntu:18.04:LTS |
All versions, plus listed versions 1.7.2-3build11.7.2-65-g2b8e6cf-11.8.1-11.8.1-1build1 |
None known |
pgbouncerUbuntu:20.04:LTS |
All versions, plus listed versions 1.10.0-11.10.0-1build11.11.0-11.12.0-21.12.0-3 |
None known |
pgbouncerUbuntu:22.04:LTS |
All versions, plus listed versions 1.15.0-11.16.1-1ubuntu1 |
None known |
pgbouncerUbuntu:24.04:LTS |
All versions, plus listed versions 1.20.0-11.21.0-11.22.0-11.22.0-1build11.22.0-1build31.22.0-1build4 |
None known |
pgbouncerUbuntu:26.10 |
All versions, plus listed versions 1.25.1-11.25.2-11.25.2-1ubuntu1 |
None known |
pgbouncerUbuntu:26.04:LTS |
All versions, plus listed versions 1.24.1-11.25.0-21.25.1-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107349 is a high vulnerability (CVSS 7.5) in pgbouncer, published October 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in pgbouncer 1.26.1-1.
References
pgbouncer.org/changelog.html
nvd.nist.gov/vuln/detail/CVE-2026-107349
github.com/advisories/GHSA-h8cj-p2h5-hm79
security-tracker.debian.org/tracker/CVE-2026-107349
access.redhat.com/errata/RHSA-2026:83843
images.redhat.com
Show 14 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83843.json
bugzilla.redhat.com/show_bug.cgi?id=2552741
cve.org/CVERecord?id=CVE-2026-107348
ubuntu.com/security/CVE-2026-107349