CVE-2026-107349 in PgBouncer
Zusammenfassung
von MITRE • 14.10.2026
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.