high7.5
CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service.
Impact
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| PgBouncer | PgBouncer 1.20.0 | through 1.26.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.