CVE-2026-107349— Infinite loop on empty option name in startup options parameter in PgBouncer
Quick assessment
Affected
n/a PgBouncer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 PgBouncer 1.20.0 至 1.26.0 版本中存在一个无限循环漏洞，允许未认证的远程攻击者导致拒绝服务（DoS）攻击。当启动消息（StartupMessage）的 options 参数中包含空的参数名（例如 "-c="）时，会导致 ignore_startup_parameters 列表的查找操作陷入无限循环。由于 PgBouncer 使用单个进程处理所有客户端连接，该漏洞会耗尽一个 CPU 核心，并使 PgBouncer 对所有客户端失去响应，直到该进程被重启。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107349
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Infinite loop on empty option name in startup options parameter in PgBouncer
Source: CVE Program / CVE List V5
Vulnerability Description
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | PgBouncer | 1.20.0 ~ 1.26.1 | - |
|
II. Public POCs for CVE-2026-107349
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107349
请登录查看更多情报信息。
Same Patch Batch · n/a · 2026-10-14 · 5 CVEs total
| CVE-2026-107350 | 8.8 HIGH | Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer |
| CVE-2026-110679 | 7.3 HIGH | OpenSIPS rtpproxy rtpproxy_answer out-of-bounds |
| CVE-2026-110698 | 6.3 MEDIUM | Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write |
| CVE-2026-107348 | 5.9 MEDIUM | Integer overflow causes an infinite loop in message buffer growth in PgBouncer |
IV. Related Vulnerabilities
Same product: PgBouncer
-
CVE-2026-107350
Authentication bypass via second StartupMessage during SCRAM -
CVE-2026-107348
Integer overflow causes an infinite loop in message buffer g -
CVE-2026-6669
Unbounded SCRAM iteration count causes CPU exhaustion in PgB -
CVE-2026-19888
NULL pointer dereference in SCRAM client-final-message parsi -
CVE-2026-6668
Integer overflow causes an infinite loop in packet buffer gr
Same weakness: CWE-835
-
CVE-2026-105273
J4Care dcm4che Loop with Unreachable Exit Condition -
CVE-2026-107621
J4Care dcm4che Loop with Unreachable Exit Condition -
CVE-2026-97370
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU l -
CVE-2026-104266
tinytag: Infinite loop when parsing certain M4A files contai -
CVE-2026-110836
FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Co
V. Comments for CVE-2026-107349
No comments yet