LoginSign Up
← Back to all sparks
P

PgBouncer

DEVOPS
Velocity2.5

Lightweight connection pooler for PostgreSQL

www.pgbouncer.org ↗

PgBouncer patches a SCRAM flaw that let a known user log in as an admin

postgresconnection-poolingsecurity-hardeningscramcve-response
◆Current state
PgBouncer's 1.26 line pairs features with a heavy security load. 1.26.0 tracks search_path and default_transaction_read_only by default, so one client's SET no longer leaks to others in transaction pooling, adds pool_idle_timeout and per-user query_wait_timeout, and removes the old online-restart takeover in favour of rolling restarts. It also fixed three CVEs. Three weeks later, 1.26.1 fixed three more, including one where a user with a password in auth_file could log in as any other SCRAM user, admins included.
◆Where it's heading
Since 1.25.1 every release has carried CVE fixes in the authentication and packet-handling paths, and 1.26.1 found a second instance of a bug class fixed weeks earlier. The project is auditing its pre-auth surface in public, while 1.26.0 shows it still cleaning up long-standing pooling surprises.
◆Prediction
More security point releases are likely while the auth and buffer code is under review; the entries give no sign of the next feature release.

◆Recent moves

  1. 21d ago

    PgBouncer 1.26.1 closes a SCRAM user-impersonation flaw

    Three CVE fixes, the worst letting a user known to auth_file impersonate any other SCRAM user, including admins, when connecting to a non-existent database. It is a must-upgrade release and the fourth release in a row with CVE fixes.

    View source ↗
  2. 1mo ago

    PgBouncer 1.26.0 stops SET search_path leaking between clients

    search_path and read-only settings are now tracked by default, ending cross-client leakage in transaction pooling, and the old takeover restart is removed. Three CVE fixes ride along, continuing the run of auth-path hardening.

    View source ↗
  3. 6mo ago

    PgBouncer 1.25.2 patches two pre-auth remote crash CVEs

    Two CVE fixes in the pre-authentication path: an integer overflow that bypassed a bounds check in packet parsing, and an unchecked strlcat return in the SCRAM code. Both let an unauthenticated remote attacker crash the pooler with a malformed packet.

    View source ↗
  4. 11mo ago

    PgBouncer 1.25.1 - Fixing a bunch of bugs before Christmas (including CVE-2025-12819)

    Fixes a vulnerability allowing arbitrary SQL execution during authentication via a malicious search_path in the StartupMessage, though only for the narrow set of deployments tracking search_path as an extra parameter. A reminder that startup-parameter passthrough is attack surface.

    View source ↗
  5. 0y ago

    PgBouncer 1.25.0 - The one with LDAP support

    ⚡ SPARK

    The release that added LDAP authentication, configurable via HBA file or auth_ldap_options, plus client-side direct TLS using the faster PostgreSQL 17 handshake. It is the largest expansion of PgBouncer's auth surface in years — and the two CVE releases that followed all landed in that same path.

    View source ↗
  6. 1y ago

    PgBouncer 1.24.1 - Fixes CVE-2025-2291

    Fixes a flaw where PgBouncer's auth_query ignored a user's password VALID UNTIL expiry, so expired passwords still worked through the proxy. The default and documented auth_query were both changed.

    View source ↗