An integer overflow in the logic that grows PgBouncer's packet buffer can cause an infinite loop when processing sufficiently large packets, leading to a denial‑of‑service condition. The integer overflow occurs during buffer size computation, causing the growth loop to never terminate. The attack can be initiated by both unauthenticated and authenticated users. When triggered, the loop consumes all CPU resources of the single PgBouncer process, stalling all pooled connections until the process is forced to exit.

The vulnerability affects PgBouncer versions up through 1.25.2. Systems running any released PgBouncer from the beginning of its public version history up to and including 1.25.2 are potentially exposed, irrespective of the specific client configuration or authentication state. No other products or versions are listed as affected.

The CVSS score of 7.5 indicates a high‑severity denial‑of‑service vulnerability. The EPSS score is not available, and the flaw is not catalogued in CISA KEV. The likely attack vector is remote network access: an attacker sends a single packet that exceeds the 1,073,741,824‑byte threshold, triggering the integer overflow and causing the process to enter an infinite loop. Because PgBouncer operates a single process for all client connections, the resulting CPU saturation stalls every pooled connection until the service is stopped. Both unauthenticated and authenticated code paths can reach the overflow, making the exploitation straightforward for adversaries with network reach.