Executive brief
PgBouncer is a popular connection pooler for PostgreSQL databases that helps manage large numbers of database connections efficiently. A vulnerability has been identified where a malicious or misconfigured database server can send a specific malformed error message that causes PgBouncer to crash. This results in a denial-of-service, preventing applications from connecting to their databases and potentially disrupting business operations.
Technical details
A NULL pointer dereference vulnerability (CWE-476) exists in PgBouncer versions prior to 1.25.2. The issue occurs when PgBouncer processes an error response from a backend PostgreSQL server that lacks the expected SQLSTATE field. An attacker who can control or spoof a backend server's responses can trigger this condition to cause a daemon crash (Denial of Service). While the attack vector is network-based, it typically requires a high complexity (AC:H) as the attacker must be in a position to act as the backend server or compromise an existing one. The vulnerability is resolved in PgBouncer version 1.25.2.
Affected products
- PostgreSQL PgBouncer < 1.25.2
Timeline
- 2026-05-08: patched: Fixed in PgBouncer version 1.25.2
- 2026-05-09: disclosed: Initial NVD publication date