What’s Vulnerable › Vulnerabilities
CVE-2026-107349: Infinite loop on empty option name in startup options parameter in PgBouncer
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-14 · updated 2026-10-16
- Weakness: CWE-400
Description
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
Affected products
- PgBouncer: from 1.20.0 before 1.26.1 — fixed in 1.26.1
How to fix
Upgrade to a fixed version: PgBouncer 1.26.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-107349 or the next vulnerability affects your stack