Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer versions 1.21.0 through 1.26.0 can cause an infinite loop when a packet header declares a length above 2^31. The loop prevents the buffer from expanding properly, which saturates a CPU core and stalls all connections served by the single‑process PgBouncer server. The denial of service can be triggered remotely by sending an oversized packet header and does not require authentication. Starting with version 1.23.0 the overflow is reachable before client authentication, allowing an attacker to exploit the flaw without establishing a connection.

The affected product is the PgBouncer database connection pooler, versions 1.21.0 through 1.26.0. The vulnerability manifests when the configuration parameter max_packet_size is set to a value above 2147483648. A remote client can trigger the issue by sending a packet header with a length field that exceeds 2^31.

The CVSS score of 5.9 indicates medium severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited remotely by crafting a packet header with a length field exceeding 2^31, causing the server to loop indefinitely. Because the loop consumes CPU time, the vulnerability can be used to disrupt service continuity without needing privileged access, and it can be triggered before authentication in newer releases.