Integer Overflow Vulnerability in PgBouncer by PostgreSQL

CVE-2026-107348

What is CVE-2026-107348?

An integer overflow vulnerability exists in the message buffer management logic of PgBouncer versions 1.21.0 through 1.26.0. This flaw allows a remote attacker to exploit the buffer growth mechanism when the max_packet_size exceeds 2147483648. By sending a packet with a header that declares a length greater than 2^31, the computation for buffer size can overflow, causing the growth loop to become unresponsive. Since PgBouncer operates using a single process to handle all client connections, this flaw can lead to a denial of service by exhausting a CPU core, thereby stalling all pooled connections until the process is restarted. Notably, this issue can be triggered even before user authentication, especially in version 1.23.0 and above.

References