CVE-2026-107349

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107349", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-07T19:13:32.963Z", "datePublished": "2026-10-14T17:34:33.785Z", "dateUpdated": "2026-10-16T20:19:16.649Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-10-14T17:34:33.785Z"}, "title": "Infinite loop on empty option name in startup options parameter in PgBouncer", "descriptions": [{"lang": "en", "value": "An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as \"-c=\", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted."}], "affected": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"version": "1.20.0", "lessThan": "1.26.1", "versionType": "semver", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-835", "type": "CWE", "description": "Loop with Unreachable Exit Condition ('Infinite Loop')"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-400", "type": "CWE", "description": "Uncontrolled Resource Consumption"}]}], "references": [{"url": "https://www.pgbouncer.org/changelog.html"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "ignore_startup_parameters is set to a non-empty value that does not contain options."}], "workarounds": [{"lang": "en", "value": "Either add options to ignore_startup_parameters, or set ignore_startup_parameters to an empty value."}], "credits": [{"lang": "en", "value": "Thanks to Jackds Security (@jackds-security) for finding and reporting this issue.", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-16T20:19:04.558160Z", "id": "CVE-2026-107349", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T20:19:16.649Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107349", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-07T19:13:32.963Z", "datePublished": "2026-10-14T17:34:33.785Z", "dateUpdated": "2026-10-16T20:19:16.649Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-10-14T17:34:33.785Z"}, "title": "Infinite loop on empty option name in startup options parameter in PgBouncer", "descriptions": [{"lang": "en", "value": "An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as \"-c=\", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted."}], "affected": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"version": "1.20.0", "lessThan": "1.26.1", "versionType": "semver", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-835", "type": "CWE", "description": "Loop with Unreachable Exit Condition ('Infinite Loop')"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-400", "type": "CWE", "description": "Uncontrolled Resource Consumption"}]}], "references": [{"url": "https://www.pgbouncer.org/changelog.html"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "ignore_startup_parameters is set to a non-empty value that does not contain options."}], "workarounds": [{"lang": "en", "value": "Either add options to ignore_startup_parameters, or set ignore_startup_parameters to an empty value."}], "credits": [{"lang": "en", "value": "Thanks to Jackds Security (@jackds-security) for finding and reporting this issue.", "type": "finder"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107349", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T20:19:04.558160Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T20:19:11.612Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"lessThan": "1.26.1", "status": "affected", "version": "1.20.0", "versionType": "semver"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as \"-c=\", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted."}], "id": "CVE-2026-107349", "lastModified": "2026-10-16T21:17:18.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107349", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T20:19:04.558160Z", "version": "2.0.3"}}]}, "published": "2026-10-14T18:17:25.557", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.pgbouncer.org/changelog.html"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-835"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "pgbouncer: pgbouncer: Denial of Service via empty parameter name in startup options", "id": "2552735", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552735"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["A flaw was found in PgBouncer. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending a startup message that contains an empty parameter name in its options. This causes PgBouncer to enter an infinite loop during startup parameter processing, consuming high CPU resources and rendering the service unresponsive to all clients until restarted."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the PgBouncer service so that only trusted application hosts and administrative clients can connect. This can be accomplished by configuring firewall filtering using firewalld or by binding PgBouncer only to internal, isolated interfaces.\nFor example, to restrict access to PgBouncer (default port 6432/TCP) to a trusted subnet (such as 192.168.1.0/24):\n1. Add a rich rule allowing only the trusted source subnet:\n# firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"192.168.1.0/24\" port port=\"6432\" protocol=\"tcp\" accept'\n2. Ensure the port is not exposed in public zones:\n# firewall-cmd --permanent --remove-port=6432/tcp\n3. Reload firewalld to apply changes:\n# firewall-cmd --reload\nCaveats: Network-level restrictions reduce exposure to untrusted external clients but do not mitigate risks originating from compromised or untrusted hosts within the allowed network. Modifying firewall rules or listener configurations can momentarily disrupt active client sessions and connection pooling."}, "name": "CVE-2026-107349", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "pgbouncer", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-14T17:34:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107349\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107349\nhttps://www.pgbouncer.org/changelog.html"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.20.0,1.26.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PgBouncer", "source": "cna", "vendor": "n/a"}, "product": "pgbouncer", "vendor": "pgbouncer"}], "created": "2026-10-14T21:15:07.388700+00:00", "updated": "2026-10-17T06:30:05.109251+00:00", "vendors": ["pgbouncer", "pgbouncer$PRODUCT$pgbouncer"]}