PgBouncer 1.26.0 has been released. This release fixes three CVEs: 1. CVE-2026-19888: DoS due to crash, triggerable by unauthenticated clients. Caused by a SCRAM client-final-message without a nonce. 2. CVE-2026-6668: DoS due to infinite loop, triggerable by unauthenticated clients. Caused by an integer overflow in the packet buffer growth logic. 3. CVE-2026-6669: DoS due to unbounded work during login, triggerable by a malicious PostgreSQL server. Caused by an unbounded SCRAM iteration count.
It also tracks `search_path` and `default_transaction_read_only` by default, adds the `pool_idle_timeout` setting, allows `query_wait_timeout` to be set per user and database, adds meson build support, and removes the deprecated online restart (`-R`) functionality. See [https://www.pgbouncer.org/2026/09/pgbouncer-1-26-0](https://www.pgbouncer.org/2026/09/pgbouncer-1-26-0) for more information, the detailed changelog, and download links. PgBouncer is a lightweight connection pooler for PostgreSQL.
