A flaw was found in PgBouncer. An unauthenticated remote attacker can exploit an integer overflow in the packet buffer growth logic by providing sufficiently large input. This causes the buffer size computation to overflow, leading to an infinite loop. As a result, a CPU core is saturated, and all pooled connections are stalled, causing a Denial of Service.
Last checked: 2026-09-23 20:50 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-23 16:33 UTC)
Fix evidence last checked: 2026-09-24 16:24 UTC