Accepted pgbouncer 1.26.1-1 (source) into unstable

Debian FTP Masters Wed, 14 Oct 2026 04:19:47 -0700
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 14 Oct 2026 12:55:24 +0200
Source: pgbouncer
Architecture: source
Version: 1.26.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PostgreSQL Maintainers <[email protected]>
Changed-By: Christoph Berg <[email protected]>
Changes:
 pgbouncer (1.26.1-1) unstable; urgency=medium
 .
   * New upstream version 1.26.1.
     * Fix CVE-2026-107350: PgBouncer 1.17.0 through 1.26.0 processed a second
       StartupMessage sent during SCRAM authentication when the client
       connected to a non-existent database. An attacker knowing the password
       of a user listed in `auth_file` could use this to log in as any other
       user that authenticates using SCRAM, including admins and backend
       superusers. This requires SCRAM authentication to be used for both
       users. The impersonated user can come from either `auth_file` or
       `auth_query`.
     * Fix CVE-2026-107349: An unauthenticated client could make PgBouncer
       1.20.0 through 1.26.0 spin forever on a CPU core, and thus stop serving
       all clients, by sending a startup `options` parameter containing an
       empty option name such as `-c=`. This is only exploitable when
       `ignore_startup_parameters` is non-empty but does not contain `options`.
     * Fix CVE-2026-107348: An integer overflow in the packet buffer growth
       logic of PgBouncer 1.21.0 through 1.26.0 could cause PgBouncer to hang
       in an infinite loop when a client sent a packet header declaring a
       length above 2^31. This is only exploitable when `max_packet_size` is
       set to 2147483649 or higher, the default of 2147483647 is not affected.
       Since 1.23.0 this is reachable before authentication. This is the same
       class of bug as CVE-2026-6668, but in a different buffer implementation.
Checksums-Sha1:
 6bc0bae72fb5ebd5341edd45576f06339ad88012 2597 pgbouncer_1.26.1-1.dsc
 8596c9267365ec26ba934a64c7403aa3f8cd24d7 898647 pgbouncer_1.26.1.orig.tar.gz
 21300e9cef9893aa510a781f184feebda3a59e86 16076 pgbouncer_1.26.1-1.debian.tar.xz
Checksums-Sha256:
 9912a523c6776ad7ceb2a9feac5c42e3e7c00123b973a5459cad803888f56c6a 2597 
pgbouncer_1.26.1-1.dsc
 00886a2994b4844cd37110970df777772cfc42a74c400522c82fba509a3f42d9 898647 
pgbouncer_1.26.1.orig.tar.gz
 66b4605556ce8b41ee2d45b0f4a3a9b5ec663c364dcedf6472b8dc65bb916ad0 16076 
pgbouncer_1.26.1-1.debian.tar.xz
Files:
 b69cb754b6a15e67fb791f7e4691a3ae 2597 database optional pgbouncer_1.26.1-1.dsc
 aaa5fd3a4b7c20b9a1086bb8be507d7a 898647 database optional 
pgbouncer_1.26.1.orig.tar.gz
 4937f06b1c79699f0996a53a8c726934 16076 database optional 
pgbouncer_1.26.1-1.debian.tar.xz
pgpunUkD2aaHY.pgp
Description: PGP signature
Accepted pgbouncer 1.26.1-1 (source) into unstable

Reply via email to
