CVE-2025-2291— PgBouncer default auth_query does not take Postgres password expiry into account
Quick assessment
Affected
n/a PgBouncer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PgBouncer是PgBouncer社区的一个 PostgreSql 的开源轻量级连接池。 PgBouncer存在安全漏洞，该漏洞源于auth_query未考虑Postgres的VALID UNTIL值，可能导致使用过期密码登录。
Possible ATT&CK Techniques 1 AI
T1078.003 · Local Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-2291
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PgBouncer default auth_query does not take Postgres password expiry into account
Source: CVE Program / CVE List V5
Vulnerability Description
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用已过期的密钥
Source: CVE Program / CVE List V5
Vulnerability Title
PgBouncer 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PgBouncer是PgBouncer社区的一个 PostgreSql 的开源轻量级连接池。 PgBouncer存在安全漏洞，该漏洞源于auth_query未考虑Postgres的VALID UNTIL值，可能导致使用过期密码登录。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | PgBouncer | 0 ~ 1.24.1 | - |
|
II. Public POCs for CVE-2025-2291
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-2291
请登录查看更多情报信息。
Vendor Pages for CVE-2025-2291 (1)
Same Patch Batch · n/a · 2025-04-16 · 19 CVEs total
| CVE-2025-3730 | 3.3 LOW | PyTorch LossCTC.cpp torch.nn.functional.ctc_loss denial of service |
| CVE-2024-40074 | SourceCodester Online ID Generator System 安全漏洞 | |
| CVE-2024-53305 | whoogle-search 安全漏洞 | |
| CVE-2024-53303 | LRQA Nettitude PoshC2 安全漏洞 | |
| CVE-2024-53304 | LRQA Nettitude PoshC2 安全漏洞 | |
| CVE-2024-40069 | SourceCodester Online ID Generator System 安全漏洞 | |
| CVE-2024-40070 | Sourcecodester Online ID Generator System 安全漏洞 | |
| CVE-2024-40068 | Sourcecodester Online ID Generator System 安全漏洞 | |
| CVE-2024-40072 | Sourcecodester Online ID Generator System 安全漏洞 | |
| CVE-2025-26153 | Chamilo LMS 安全漏洞 | |
| CVE-2024-40071 | Sourcecodester Online ID Generator System 安全漏洞 | |
| CVE-2024-40073 | SourceCodester Online ID Generator System 安全漏洞 | |
| CVE-2024-55372 | Wallos 安全漏洞 | |
| CVE-2024-55371 | Wallos 安全漏洞 | |
| CVE-2025-29710 | SourceCodester Company Website CMS 安全漏洞 | |
| CVE-2025-29708 | SourceCodester Company Website CMS 安全漏洞 | |
| CVE-2025-29709 | SourceCodester Company Website CMS 安全漏洞 | |
| CVE-2025-28072 | PHPGurukul Pre-School Enrollment System 安全漏洞 |
IV. Related Vulnerabilities
Same product: PgBouncer
-
CVE-2026-6669
Unbounded SCRAM iteration count causes CPU exhaustion in PgB -
CVE-2026-19888
NULL pointer dereference in SCRAM client-final-message parsi -
CVE-2026-6668
Integer overflow causes an infinite loop in packet buffer gr -
CVE-2026-6667
PgBouncer missing authorization check in KILL_CLIENT admin c -
CVE-2026-6666
PgBouncer crash in kill_pool_logins_server_error
Same vendor: n/a
-
CVE-2026-103531
OpenSC card-setcos.c setcos_construct_fci_44 stack-based ove -
CVE-2026-103227
GPAC DASH Client dash_client.c gf_dash_resolve_url buffer ov -
CVE-2026-103118
GraphicsMagick WPG File wpg.c ExtractPostscript recursion -
CVE-2026-51870
DeepTutor v1.4.0 命令执行漏洞 -
CVE-2026-51858
camel-ai 0.2.91a3 shell_exec命令执行漏洞
Same weakness: CWE-324
-
CVE-2026-39923
Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST -
CVE-2026-54787
sigstore-go fails to check signature timestamps against a si -
CVE-2026-52809
Gogs: Password-reset tokens use account-activation lifetime, -
CVE-2025-13723
IBM Sterling Partner Engagement Manager Information Disclosu -
CVE-2025-33012
IBM Db2 improper account lockout
V. Comments for CVE-2025-2291
No comments yet