Your message dated Tue, 29 Sep 2026 14:46:18 +0200
with message-id <[email protected]>
and subject line Re: Bug#1148946: pgbouncer: CVE-2026-6668 CVE-2026-6669
CVE-2026-19888
has caused the Debian Bug report #1148946,
regarding pgbouncer: CVE-2026-6668 CVE-2026-6669 CVE-2026-19888
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148946: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148946
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: pgbouncer
Version: 1.25.2-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for pgbouncer.
CVE-2026-6668[0]:
| Integer overflow in the packet buffer growth logic in PgBouncer
| through 1.25.2 allows an unauthenticated remote attacker to cause a
| denial of service. Sufficiently large input makes the buffer size
| computation overflow, leaving the growth loop unable to terminate.
| Because PgBouncer serves all clients from a single process, this
| saturates a CPU core and stalls every pooled connection until the
| process is killed. Both unauthenticated and authenticated code paths
| can reach the overflow.
CVE-2026-6669[1]:
| Missing upper bound on the key derivation iteration count accepted
| during SCRAM authentication to a backend server in PgBouncer through
| 1.25.2 allows a malicious or compromised PostgreSQL backend to cause
| uncontrolled CPU consumption in PgBouncer. The resulting key
| derivation cannot be interrupted in frontend builds such as
| PgBouncer. Because PgBouncer serves all clients from a single
| process, one backend can in this way stop it from serving traffic
| for every other database and client it is pooling, so the failure of
| a single backend is not contained.
CVE-2026-19888[2]:
| Missing validation of a mandatory attribute in the SCRAM client-
| final-message parser in PgBouncer through 1.25.2 allows an
| unauthenticated remote attacker to crash the process. A malformed
| message can make the parser report success while leaving a required
| value unset, which is then dereferenced as a NULL pointer. The crash
| occurs before any credential is verified, so no valid account is
| required. Because PgBouncer serves all clients from a single
| process, this terminates every pooled connection.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-6668
https://www.cve.org/CVERecord?id=CVE-2026-6668
[1] https://security-tracker.debian.org/tracker/CVE-2026-6669
https://www.cve.org/CVERecord?id=CVE-2026-6669
[2] https://security-tracker.debian.org/tracker/CVE-2026-19888
https://www.cve.org/CVERecord?id=CVE-2026-19888
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Version: 1.26.0-1
Re: Salvatore Bonaccorso
> The following vulnerabilities were published for pgbouncer.
Fixed in the last upload but missed in the changelog.
Christoph
--- End Message ---
