PgBouncer 1.26.0 released - Fixes three CVEs

Дата публикации: 23-09-2026 00:00:00

PgBouncer 1.26.0 has been released. This release fixes three CVEs:
CVE-2026-19888: DoS due to crash, triggerable by unauthenticated clients. Caused by a SCRAM client-final-message without a nonce.
CVE-2026-6668: DoS due to infinite loop, triggerable by unauthenticated clients. Caused by an integer overflow in the packet buffer growth logic.
CVE-2026-6669: DoS due to unbounded work during login, triggerable by a malicious PostgreSQL server. Caused by an unbounded SCRAM iteration count.
It also tracks search_path and default_transaction_read_only by default, adds the pool_idle_timeout setting, allows query_wait_timeout to be set per user and database, adds meson build support, and removes the deprecated online restart (-R) functionality.
See https://www.pgbouncer.org/2026/09/pgbouncer-1-26-0 for more information, the detailed changelog, and download links.
PgBouncer is a lightweight connection pooler for PostgreSQL.

Основное содержимое страницы с новостью.

Схожие новости

#	Наименование новости	Тональность	Информативность	Дата публикации
1	pgAdmin 4 v9.18 Released	0	10.22	17-09-2026
2	PostgreSQL Migrator 1.0 : first stable release	0	10.42	10-09-2026
3	Barman 3.19.0 and 3.19.1 Released	2	6	08-07-2026
4	pgsql-test: Real Postgres Testing for Faster Development Loops	0	7.47	22-09-2026
5	PostgreSQL 19 Beta 4 Released!	0	8.58	24-09-2026
6	PostGREShell: в PostgreSQL обнаружили существовавшую 12 лет возможность запуска произвольного кода	0	18.01	09-09-2026
7	PostgreSQL 19 Beta 2 Released!	5	7	16-07-2026
8	PostgreSQL JDBC 42.7.12 Security Release	0	18.82	06-07-2026
9	PGX announces support for EOL versions of PostgreSQL	0	11.2	25-06-2026
10	Odyssey 1.5.1 released	5	7	14-07-2026

Классификация: . Схожих патентов: 0. Схожих новостей: 10. Тональность: 0. Информативность: 6.66. Источник: www.postgresql.org.