CVE-2025-2291: PgBouncer default auth_query does not take Postgres password expiry into account

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-16 · updated 2026-06-17
Weakness: CWE-324

Description

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

Affected products

Debian Linux: 11.0
PgBouncer: before 1.24.1 — fixed in 1.24.1

How to fix

Upgrade to a fixed version: PgBouncer 1.24.1. Check the vendor advisory for mitigations.

References

https://www.pgbouncer.org/changelog.html#pgbouncer-124x
https://lists.debian.org/debian-lts-announce/2025/05/msg00032.html

Get alerted when CVE-2025-2291 or the next vulnerability affects your stack