CVE-2026-107348 PgBouncer CVE debrief

Who should care

Defenders responsible for PgBouncer deployments, particularly those with max_packet_size configured above 2147483648, should assess exposure and prioritize verification and updates.

Why it matters

Defenders should care about CVE-2026-107348 because it allows a remote attacker to cause a denial of service in PgBouncer, potentially leading to CPU core saturation and stalled connections. Those responsible for PgBouncer deployments, especially with max_packet_size configured above 2147483648, should assess exposure and prioritize verification and updates.

• Denial of service due to infinite loop in message buffer growth
• CPU core saturation and stalled pooled connections until process restart
• Potential for traffic pattern anomalies indicative of exploitation attempts

Technical summary

The integer overflow vulnerability in PgBouncer's message buffer growth logic allows a remote attacker to cause a denial of service by sending a specially crafted packet header. This vulnerability affects PgBouncer 1.21.0 through 1.26.0 and can be triggered when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted.

Defensive priority

Defenders should prioritize verifying and updating PgBouncer to version 1.26.1 or later, and monitoring for unusual traffic patterns that could be indicative of exploitation attempts.

Recommended defensive actions

• Verify and update PgBouncer to version 1.26.1 or later
• Monitor for unusual traffic patterns that could be indicative of exploitation attempts
• Review and adjust max_packet_size configuration to prevent overflow
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the integer overflow vulnerability in PgBouncer. The vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted packet header. There is no information on exploitation or affected systems. Defenders should verify and update PgBouncer to version 1.26.1 or later and monitor for unusual traffic patterns that could be indicative of exploitation attempts. The source item provides details on the integer overflow vulnerability in PgBouncer, but does not

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.