CVE-2025-2291: PgBouncer default auth_query does not take Postgres password expiry into account
Password can be used past expiry in PgBouncer due to authquery not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
Other sources
PgBouncer default authquery does not take Postgres password expiry into account
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.24.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2291?
CVE-2025-2291 is classified as a high severity vulnerability due to the risk of unauthorized access with expired passwords.
How do I fix CVE-2025-2291?
To fix CVE-2025-2291, update PgBouncer to the latest version where the issue is resolved.
What systems are affected by CVE-2025-2291?
CVE-2025-2291 affects PgBouncer installations that do not correctly enforce password expiry based on Postgres' VALID UNTIL value.
What exploits are possible with CVE-2025-2291?
An attacker can exploit CVE-2025-2291 to log in using expired passwords, potentially gaining unauthorized access to the database.
What precautions should be taken regarding CVE-2025-2291?
Organizations should regularly update PgBouncer and review their authentication processes to ensure compliance with password expiry policies.