PgBouncer 1.26.0 closes three denial-of-service holes reachable before login
Serguey Asael Shinder2 min readPgBouncer 1.26.0 was released on 23 September 2026, fixing three CVEs. All three are denial of service, and the interesting part is who can reach them:
- CVE-2026-19888 — a crash triggerable by unauthenticated clients, caused by a SCRAM
client-final-messagearriving without a nonce. - CVE-2026-6668 — an infinite loop, also unauthenticated, caused by an integer overflow in the packet buffer growth logic.
- CVE-2026-6669 — unbounded work during login, triggerable by a malicious PostgreSQL server, caused by an unbounded SCRAM iteration count.
The same release brings changes that have nothing to do with the CVEs: it now tracks search_path and default_transaction_read_only by default, adds a pool_idle_timeout setting, allows query_wait_timeout to be set per user and per database, adds meson build support, and removes the deprecated online restart (-R).
The part worth noticing
Two of the three are pre-authentication, and that is what decides where PgBouncer can sit. A connection pooler is usually placed exactly where an unauthenticated client can talk to it — that is its job, to be the thing in front. So "DoS triggerable by unauthenticated clients" is not a qualified risk here, it is the ordinary case.
The third is the one worth thinking about longer. CVE-2026-6669 is triggered by the PostgreSQL server, not the client — an unbounded SCRAM iteration count sent back during login. That inverts the usual direction of trust: the pooler is normally hardened against what arrives from in front of it, while the database behind it is assumed friendly. It is a useful reminder that a proxy has two sides and both of them speak a protocol it has to parse.
And the removal of -R is the line to read if you run PgBouncer in production. Online restart was the mechanism for handing sockets to a new process without dropping client connections; it is gone, not deprecated further. Anyone whose deploy script relies on it needs a different plan before this upgrade, which makes 1.26.0 a release you read the changelog for even though it is a point release.