CVE-2026-107348— Integer overflow causes an infinite loop in message buffer growth in PgBouncer
Quick assessment
Affected
n/a PgBouncer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 PgBouncer 1.21.0 至 1.26.0 版本中，消息缓冲区增长逻辑（mbuf_make_room）存在整数溢出漏洞。当配置参数 max_packet_size 大于 2147483648 时，远程攻击者可利用此漏洞导致拒绝服务（DoS）。 具体而言，若数据包头部声明的长度超过 2^31，将导致缓冲区大小计算发生整数溢出，使得缓冲区增长循环无法终止。由于 PgBouncer 使用单个进程服务所有客户端，该缺陷会占用一个 CPU 核心，并阻塞所有已建立的连接池中的连接，直到该进程被重启。 自版本 1.2
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107348
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Integer overflow causes an infinite loop in message buffer growth in PgBouncer
Source: CVE Program / CVE List V5
Vulnerability Description
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | PgBouncer | 1.21.0 ~ 1.26.1 | - |
|
II. Public POCs for CVE-2026-107348
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107348
请登录查看更多情报信息。
Same Patch Batch · n/a · 2026-10-14 · 5 CVEs total
| CVE-2026-107350 | 8.8 HIGH | Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer |
| CVE-2026-107349 | 7.5 HIGH | Infinite loop on empty option name in startup options parameter in PgBouncer |
| CVE-2026-110679 | 7.3 HIGH | OpenSIPS rtpproxy rtpproxy_answer out-of-bounds |
| CVE-2026-110698 | 6.3 MEDIUM | Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write |
IV. Related Vulnerabilities
Same product: PgBouncer
-
CVE-2026-107350
Authentication bypass via second StartupMessage during SCRAM -
CVE-2026-107349
Infinite loop on empty option name in startup options parame -
CVE-2026-6669
Unbounded SCRAM iteration count causes CPU exhaustion in PgB -
CVE-2026-19888
NULL pointer dereference in SCRAM client-final-message parsi -
CVE-2026-6668
Integer overflow causes an infinite loop in packet buffer gr
Same weakness: CWE-190
-
CVE-2026-102692
RIOT: Potential integer overflow in nanocoap Block2 handling -
CVE-2026-57488
pupnp: Integer truncation in HTTP Content-Length parsing ena -
CVE-2026-105959
Spice-server: spice: heap buffer overflow via glz dictionary -
CVE-2026-111380
FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple B -
CVE-2026-111282
iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_Re
V. Comments for CVE-2026-107348
No comments yet