CVE-2026-107348 in PgBouncer
Summary
by MITRE • 10/14/2026
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in PgBouncer versions 1.21.0 through 1.26.0 represents a critical integer overflow within the message buffer growth logic, specifically located in the mbuf_make_room function. This flaw arises from an improper handling of packet length fields during memory allocation and resizing operations. When a client sends a packet header that declares a size exceeding two to the power of thirty-one bytes, the arithmetic operation used to calculate the required buffer space overflows. Instead of detecting this invalid input or rejecting it, the system proceeds with a truncated, significantly smaller value for the buffer size calculation. This mathematical error fundamentally breaks the logic governing memory expansion, leading to an infinite loop as the software attempts repeatedly and unsuccessfully to allocate sufficient memory based on corrupted parameters.
From a technical perspective, this issue is classified under CWE-190, which denotes Integer Overflow or Wraparound. The vulnerability allows for remote exploitation without requiring prior authentication in versions starting from 1.23.0. An attacker can trigger the condition by sending a specially crafted five-byte packet header that specifies an excessively large length value. Because PgBouncer operates as a single-process server managing multiple client connections, the impact of this flaw is severe and systemic rather than isolated to a specific session. The infinite loop caused by the buffer growth failure consumes one hundred percent of a CPU core dedicated to processing that connection. This resource exhaustion does not remain contained; it stalls every pooled connection handled by that process, effectively rendering the database proxy unresponsive for all users relying on its services until the affected PgBouncer instance is manually restarted or terminated.
The operational impact of this vulnerability constitutes a high-severity denial of service condition. Since the flaw can be triggered remotely and without authentication in recent versions, it presents an attractive target for malicious actors seeking to disrupt database availability. The attack vector aligns with ATT&CK technique T1498, Network Denial of Service, specifically involving resource exhaustion through infinite loops or memory leaks induced by malformed input. The ability to stall all pooled connections means that the entire backend infrastructure protected by PgBouncer becomes inaccessible during the duration of the attack, leading to significant downtime and potential data loss if transactions are interrupted mid-flight.
Mitigation strategies must prioritize immediate patching for organizations running vulnerable versions. Upgrading to a version of PgBouncer later than 1.26.0 is the primary remediation step, as these releases include fixes that properly validate packet lengths before performing buffer size calculations. For environments where an upgrade cannot be implemented immediately, network-level controls such as ingress firewalls or intrusion prevention systems can be configured to drop packets with header sizes exceeding standard database protocol limits. Additionally, configuring PgBouncer to enforce stricter max_packet_size settings below the overflow threshold of two billion one hundred forty-seven million four hundred eighty-three thousand six hundred forty-eight bytes may reduce exposure, although this is a less robust defense than applying the vendor patch. Regular monitoring for unusual CPU spikes on PgBouncer hosts can also aid in early detection of such exploitation attempts.