PG
Product
PgBouncer
11
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 1High 7Medium 3Low 0
Watch
Add PgBouncer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107350 | 8.8 | Oct 14 | Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer Affected: 1.17.0 before 1.26.1 |
| CVE-2025-12819 | 8.1 | Dec 3 | Untrusted search path in auth_query connection in PgBouncer Affected: before 1.25.1 |
| CVE-2026-107349 | 7.5 | Oct 14 | Infinite loop on empty option name in startup options parameter in PgBouncer Affected: 1.20.0 before 1.26.1 |
| CVE-2026-19888 | 7.5 | Sep 23 | NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer Affected: through 1.25.2 |
| CVE-2026-6668 | 7.5 | Sep 23 | Integer overflow causes an infinite loop in packet buffer growth in PgBouncer Affected: through 1.25.2 |
| CVE-2026-6666 | 7.5 | May 9 | PgBouncer crash in kill_pool_logins_server_error Affected: before 1.25.2 |
| CVE-2026-6664 | 7.5 | May 9 | PgBouncer integer overflow in PgBouncer network packet parsing Affected: before 1.25.2 |
Showing 7