Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by PostgreSQL

CVE-2026-107348Integer overflow causes an infinite loop in message buffer growth in PgBouncer

Medium 5.9

In plain English

A medium-severity integer overflow in PgBouncer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.4%top 66.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12pgbouncerno fix listedDEBIAN-CVE-2026-107348
Debian:13pgbouncerno fix listedDEBIAN-CVE-2026-107348
Debian:14pgbouncer1.26.1-1DEBIAN-CVE-2026-107348
Ubuntu:22.04:LTSpgbouncerno fix listedUBUNTU-CVE-2026-107348
Ubuntu:24.04:LTSpgbouncerno fix listedUBUNTU-CVE-2026-107348
Ubuntu:26.04:LTSpgbouncerno fix listedUBUNTU-CVE-2026-107348
Ubuntu:26.10pgbouncerno fix listedUBUNTU-CVE-2026-107348

Affected products (as reported)

VendorProductVersions
n/a PgBouncer 1.21.0 – before 1.26.1

Weakness: CWE-190, CWE-835 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References