PG
Vendor
Pgbouncer
10
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-6667 | PG Pgbouncer Pgbouncer | 4.3 | May 9 | PgBouncer missing authorization check in KILL_CLIENT admin command |
| CVE-2026-6666 | PG Pgbouncer Pgbouncer | 7.5 | May 9 | PgBouncer crash in kill_pool_logins_server_error |
| CVE-2026-6665 | PG Pgbouncer Pgbouncer | 9.8 | May 9 | PgBouncer buffer overflow in SCRAM |
| CVE-2026-6664 | PG Pgbouncer Pgbouncer | 7.5 | May 9 | PgBouncer integer overflow in PgBouncer network packet parsing |
| CVE-2025-12819 | PG Pgbouncer Pgbouncer | 8.1 | Dec 3 | Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious… |
| CVE-2025-2291 | PG Pgbouncer Pgbouncer | 9.8 | Apr 16 | Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired… |
| CVE-2021-3672 | PG Pgbouncer Pgbouncer | 5.6 | Nov 23 | A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might… |
| CVE-2021-3935 | PG Pgbouncer Pgbouncer | 8.1 | Nov 22 | When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of… |
| CVE-2015-6817 | PG Pgbouncer Pgbouncer | 8.1 | May 23 | PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username |
| CVE-2015-4054 | PG Pgbouncer Pgbouncer | 7.5 | May 23 | PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet |