Description
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
Published: 2026-10-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service caused by an infinite loop that saturates a CPU core and renders PgBouncer unresponsive
Action: Patch
AI Analysis

Impact

PgBouncer versions 1.20.0 through 1.26.0 contain an infinite loop that can be triggered by an unauthenticated remote attacker sending a StartupMessage with an empty option name (e.g., "-c=") in the options parameter. The loop occurs during lookup in the ignore_startup_parameters list, consuming an entire CPU core and causing the service to become unresponsive to all clients, effectively a denial of service. The underlying weakness involves uncontrolled resource consumption (CWE-400) and an infinite loop (CWE-835).

Affected Systems

This vulnerability affects the PgBouncer product released by its vendor, specifically versions 1.20.0 through 1.26.0. No other vendors, products, or additional version details are provided.

Risk and Exploitability

The CVSS score of 7.5 categorizes this flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no confirmed exploitation yet. However, the attack requires only the ability to send a malformed StartupMessage over the PgBouncer connection, so an unauthenticated remote attacker can exploit it via network access to a PgBouncer instance, making the denial of service a practical threat.

Generated by OpenCVE AI on October 15, 2026 at 14:38 UTC.

Remediation

Vendor Workaround

Either add options to ignore_startup_parameters, or set ignore_startup_parameters to an empty value.

OpenCVE Recommended Actions

  • Upgrade PgBouncer to a version that includes the fix (1.27.0 or later).
  • If upgrading is not feasible, configure ignore_startup_parameters to be an empty value (e.g., ignore_startup_parameters=) to prevent the infinite loop.
  • Optionally, add the specific problematic option names (such as the empty "c" parameter) to the ignore_startup_parameters list so they are ignored during lookup.

Generated by OpenCVE AI on October 15, 2026 at 14:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Pgbouncer
Pgbouncer pgbouncer
Vendors & Products Pgbouncer
Pgbouncer pgbouncer

Fri, 16 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 14 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
Title Infinite loop on empty option name in startup options parameter in PgBouncer
Weaknesses CWE-400
CWE-835
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Pgbouncer Pgbouncer
cve-icon MITRE

Status: PUBLISHED

Assigner: PostgreSQL

Published:

Updated: 2026-10-16T20:19:16.649Z

Reserved: 2026-10-07T19:13:32.963Z

Link: CVE-2026-107349

cve-icon Vulnrichment

Updated: 2026-10-16T20:19:11.612Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T18:17:25.557

Modified: 2026-10-16T21:17:18.340

Link: CVE-2026-107349

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-14T17:34:33Z

Links: CVE-2026-107349 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T06:30:05Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')