CVE-2026-107349: Infinite loop on empty option name in startup options parameter in PgBouncer
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
Other sources
Infinite loop on empty option name in startup options parameter in PgBouncer
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.26.1-1 - Upgrade
Upgrade
debian/pgbouncerto a version that resolves this vulnerability.Fixed in 1.26.1-1
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
PgBouncer versions 1.20.0 through 1.26.0 are affected. An affected instance can become unresponsive to all clients because it serves clients from a single process.
What does an attacker need to exploit the issue?
The attacker only needs network access to send a StartupMessage to PgBouncer. No authentication, user interaction, or special privileges are required.
What request triggers the condition?
A StartupMessage with an options parameter containing an empty parameter name triggers the loop. The example given is "-c=".
What can be done if an instance is already unresponsive?
The PgBouncer process must be restarted to restore service. The affected process otherwise loops indefinitely and saturates a CPU core.