CVE-2026-107349: PgBouncer, отказ на услуга

Описание

Оригинално описание

An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.

Засегнати продукти

• n/a PgBouncer: 1.20.0 преди 1.26.1

Вид слабост

• CWE-835 Loop with Unreachable Exit Condition
• CWE-400 Неконтролирано потребление на ресурси

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-107349
• https://nvd.nist.gov/vuln/detail/CVE-2026-107349
• https://www.pgbouncer.org/changelog.html