LoginSign Up
← Back to all sparks
P

PgBouncer

DEVOPS
Velocity0.0

Lightweight connection pooler for PostgreSQL

www.pgbouncer.org ↗

PgBouncer added LDAP and direct TLS, then spent two releases patching auth-path CVEs

postgresconnection-poolingldaptlssecurity-hardening
◆Current state
PgBouncer's 1.25 line introduced LDAP authentication and client-side direct TLS connections, the faster handshake PostgreSQL 17 added. The two releases since have been security patches: an integer overflow in packet parsing and an unchecked strlcat return in the SCRAM code, both remotely crashable pre-auth, following a December fix for arbitrary SQL execution via a malicious search_path in the startup message.
◆Where it's heading
The pattern is unmistakable — every recent vulnerability sits in the authentication path, which is exactly where PgBouncer has been adding surface. LDAP, SCRAM handling and startup-parameter tracking all expanded what the proxy parses before a client is trusted. The connection-limit and admin-console work in 1.24 suggests a parallel track aimed at multi-tenant operators.
◆Prediction
Expect continued hardening of the pre-authentication parsing path, and eventually server-side direct TLS, which 1.25.0 explicitly noted PgBouncer cannot yet do.

◆Recent moves

  1. 2mo ago

    PgBouncer 1.25.2 patches two pre-auth remote crash CVEs

    Two CVE fixes in the pre-authentication path: an integer overflow that bypassed a bounds check in packet parsing, and an unchecked strlcat return in the SCRAM code. Both let an unauthenticated remote attacker crash the pooler with a malformed packet.

    View source ↗
  2. 8mo ago

    PgBouncer 1.25.1 - Fixing a bunch of bugs before Christmas (including CVE-2025-12819)

    Fixes a vulnerability allowing arbitrary SQL execution during authentication via a malicious search_path in the StartupMessage, though only for the narrow set of deployments tracking search_path as an extra parameter. A reminder that startup-parameter passthrough is attack surface.

    View source ↗
  3. 9mo ago

    PgBouncer 1.25.0 - The one with LDAP support

    ⚡ SPARK

    The release that added LDAP authentication, configurable via HBA file or auth_ldap_options, plus client-side direct TLS using the faster PostgreSQL 17 handshake. It is the largest expansion of PgBouncer's auth surface in years — and the two CVE releases that followed all landed in that same path.

    View source ↗
  4. 1y ago

    PgBouncer 1.24.1 - Fixes CVE-2025-2291

    Fixes a flaw where PgBouncer's auth_query ignored a user's password VALID UNTIL expiry, so expired passwords still worked through the proxy. The default and documented auth_query were both changed.

    View source ↗
  5. 1y ago

    PgBouncer 1.24.0

    Operator-facing additions: a KILL_CLIENT admin command, and per-user and per-database client connection limits configurable both globally and individually. These are the controls multi-tenant deployments need to stop one tenant exhausting the pool.

    View source ↗
  6. 2y ago

    PgBouncer 1.23.1

    A cleanup release fixing a segfault after config reload and the put_in_order crashes introduced in 1.23.0. Regression repair on the immediately preceding version.

    View source ↗