CVE-2026-107348: Integer overflow causes an infinite loop in message buffer growth in PgBouncer
Integer overflow in the message buffer growth logic (mbufmakeroom) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when maxpacketsize is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure max_packet_size to 2147483648 or lower; the denial-of-service condition occurs when it is configured above 2147483648.
PgBouncer max_packet_size = 2147483648 or lower
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
PgBouncer versions 1.21.0 through 1.26.0 are affected when max_packet_size is configured above 2147483648. The impact is process-wide: one triggered loop can stall every pooled connection served by that PgBouncer process.
What does an attacker need to send to trigger the issue?
The attacker must be able to send a packet with a header declaring a length greater than 2^31. In versions since 1.23.0, the vulnerable path can be reached before authentication using a five-byte packet header.
What can be done if an update cannot be applied immediately?
Ensure max_packet_size is not configured above 2147483648, as that configuration is required for the described overflow condition. If the issue is triggered, the affected PgBouncer process must be restarted to restore pooled connections.