Pgbouncer vulnerabilities

Products

• Pgbouncer 10

Newest

• pgbouncer PgBouncer missing authorization check in KILL_CLIENT admin command CVE-2026-6667 Fix available 4.3 MediumMay 9, 2026
• pgbouncer PgBouncer crash in kill_pool_logins_server_error CVE-2026-6666 Public exploitFix available 5.9 MediumMay 9, 2026
• pgbouncer PgBouncer buffer overflow in SCRAM CVE-2026-6665 Fix available 8.1 HighMay 9, 2026
• pgbouncer PgBouncer integer overflow in PgBouncer network packet parsing CVE-2026-6664 Public exploitFix available 7.5 HighMay 9, 2026
• pgbouncer Untrusted search path in auth_query connection in PgBouncer CVE-2025-12819 Fix available 7.5 HighDecember 3, 2025
• pgbouncer, debian linux +1 more PgBouncer default auth_query does not take Postgres password expiry into account CVE-2025-2291 Fix available 8.1 HighApril 16, 2025
• pgbouncer, debian linux, fedoraproject fedora +1 more +3 more When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can... CVE-2021-3935 Fix available 8.1 HighNovember 22, 2021
• c-ares, fedoraproject fedora, nodejs node.js +14 more +16 more A flaw was found in c-ares library, where a missing input validation check of host names returned... CVE-2021-3672 Fix available 5.6 MediumAugust 10, 2021
• pgbouncer PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain... CVE-2015-6817 Fix available 8.1 HighMay 23, 2017
• pgbouncer PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer... CVE-2015-4054 Fix available 7.5 HighMay 23, 2017