PgBouncer 1.26.1 released - Fixes three CVEs
PgBouncer 1.26.1 has been released. This release fixes three CVEs: CVE-2026-107350: Authentication bypass, allowing a client that knows the password of one SCRAM user to log in as any other SCRAM user, including admins and backend superusers. Caused by a second StartupMessage being processed during SCRAM authentication when connecting to a non-existent database.
CVE-2026-107349: DoS due to infinite loop, triggerable by unauthenticated clients. Caused by an empty option name in the startup options parameter, when ignore_startup_parameters is non-empty but does not contain options…
Read the full report on Postgresql
Story file
- Section
- Tech
- Topics
- Startups
- First reported by
- Postgresql
- Published
- Wednesday, 14 October 2026, 5:30 am IST
- Coverage
- One outlet so far
How this page works. The Headline Update lists this report from Postgresql with a short summary and a link to the original. The original reporting belongs to the publisher. Spotted an error in our summary? Tell our corrections desk.
