# CVE-2026-107349: PgBouncer infinite loop denial of service in startup message parsing

Source: https://junglewise.ai/threats/cve-2026-107349-an-infinite-loop-in-pgbouncer-1-20-0-through-1-26-0-allows-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107349 · Severity: high · CVSS 7.5 · Published 2026-10-14

PgBouncer is a connection pooler for PostgreSQL databases that routes client connections to backend servers. An unauthenticated attacker can send a specially crafted network message to cause PgBouncer to enter an infinite loop, consuming a CPU core and making the service unresponsive to all clients until it is manually restarted.

Technologies: [PgBouncer](https://junglewise.ai/threats/technologies/pgbouncer-pgbouncer). Vendors: [PgBouncer](https://junglewise.ai/threats/vendors/pgbouncer).

## Quick answers

**Is CVE-2026-107349 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107349 being exploited in the wild.

**How severe is CVE-2026-107349?** High severity, with a CVSS score of 7.5, published 14 October 2026.

**Which products and versions are affected?** PgBouncer 1.20.0 through 1.26.0.

**Is there a fix for CVE-2026-107349?** Yes: fixed in PgBouncer 1.26.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107349 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-107349?** Check whether you run PgBouncer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in PgBouncer 1.26.1

## Technical details

An infinite loop occurs in the ignore_startup_parameters list lookup when processing a PostgreSQL StartupMessage with an empty parameter name (e.g., "-c="). Since PgBouncer uses a single process to serve all clients, the CPU-bound loop saturates a core and halts all client operations. The vulnerability requires that ignore_startup_parameters be non-empty but not contain the specific option being processed; it is triggered pre-authentication via the network.

## Affected products

- pgbouncer PgBouncer 1.20.0 through 1.26.0

## Timeline

- 2026-10-14: disclosed
- 2026-10-14: patched: PgBouncer 1.26.1 released

## References

- [https://www.pgbouncer.org/changelog.html](https://www.pgbouncer.org/changelog.html)

## Related threats

- [PgBouncer authentication bypass in SCRAM](https://junglewise.ai/threats/cve-2026-107350-improper-authentication-in-pgbouncer-1-17-0-through-1-26-0)
- [PgBouncer uncontrolled CPU consumption in SCRAM authentication](https://junglewise.ai/threats/cve-2026-6669-missing-upper-bound-on-the-key-derivation-iteration-count-accepted)
- [PgBouncer integer overflow in packet buffer growth](https://junglewise.ai/threats/cve-2026-6668-integer-overflow-in-the-packet-buffer-growth-logic-in-pgbouncer)
- [Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker…](https://junglewise.ai/threats/cve-2025-12819-untrusted-search-path-in-auth-query-connection-handler-in)