CVE-2026-107348: PgBouncer, грешка в паметта

Описание

Оригинално описание

Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.

Засегнати продукти

• n/a PgBouncer: 1.21.0 преди 1.26.1

Вид слабост

• CWE-190 Целочислено препълване отгоре
• CWE-835 Loop with Unreachable Exit Condition

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-107348
• https://nvd.nist.gov/vuln/detail/CVE-2026-107348
• https://www.pgbouncer.org/changelog.html