Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wLjmP-001zID-1z for pgsql-pkg-debian@arkaria.postgresql.org; Sat, 09 May 2026 15:39:49 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wLjmO-00DSXB-1u for pgsql-pkg-debian@arkaria.postgresql.org; Sat, 09 May 2026 15:39:48 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wLjmO-00DSX3-1J for pgsql-pkg-debian@lists.postgresql.org; Sat, 09 May 2026 15:39:48 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wLjmL-00000000zvg-2bbO for pgsql-pkg-debian@lists.postgresql.org; Sat, 09 May 2026 15:39:47 +0000 Received: from atalia.postgresql.org ([2001:4800:3e1:1::231]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wLjmK-002sEf-2I for pgsql-pkg-debian@lists.postgresql.org; Sat, 09 May 2026 15:39:45 +0000 Received: from aptuser by atalia.postgresql.org with local (Exim 4.98.2) (envelope-from ) id 1wLjmK-00000001T6K-0q8C for pgsql-pkg-debian@lists.postgresql.org; Sat, 09 May 2026 15:39:44 +0000 From: apt.postgresql.org Repository Update To: PostgreSQL on Debian and Ubuntu Reply-To: PostgreSQL on Debian and Ubuntu Subject: pgbouncer updated to version 1.25.2-1.pgdg+1 Message-Id: Date: Sat, 09 May 2026 15:39:44 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk The package pgbouncer was updated on apt.postgresql.org. apt-listchanges: Changelogs --------------------------- pgbouncer (1.25.2-1.pgdg+1) sid-pgdg; urgency=medium * Rebuild for sid-pgdg. * No source changes. -- PostgreSQL on Debian and Ubuntu Sat, 09 May 2026 14:09:02 +0200 pgbouncer (1.25.2-1) unstable; urgency=medium [ Bradford D. Boyle ] * New upstream version 1.25.2. - Security * Fix CVE-2026-6664: An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet. * Fix CVE-2026-6665: The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow. * Fix CVE-2026-6666: A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field. * Fix CVE-2026-6667: PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter. - Fixes * Clarify documentation of default_pool_size parameter. * Correct documentation regarding client_tls13_ciphers and server_tls13_ciphers. -- Christoph Berg Sat, 09 May 2026 14:09:02 +0200 New version 1.25.2-1.pgdg+1: pgbouncer | 1.25.2-1.pgdg+1 | sid-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.1-1.pgdg+1 | sid-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.2-1.pgdg14+1 | forky-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.1-1.pgdg14+1 | forky-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.2-1.pgdg13+1 | trixie-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.1-1.pgdg13+1 | trixie-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.2-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.1-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.2-1.pgdg11+1 | bullseye-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.1-1.pgdg11+1 | bullseye-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.2-1.pgdg26.04+1 | resolute-pgdg | amd64, source pgbouncer | 1.25.1-1.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.2-1.pgdg25.10+1 | questing-pgdg | amd64, source pgbouncer | 1.25.1-1.pgdg25.10+1 | questing-pgdg | amd64, source pgbouncer | 1.25.2-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.1-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.2-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.25.1-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el, source pgbouncer-dbgsym | 1.25.2-1.pgdg+1 | sid-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.1-1.pgdg+1 | sid-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.2-1.pgdg14+1 | forky-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.1-1.pgdg14+1 | forky-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.2-1.pgdg13+1 | trixie-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.1-1.pgdg13+1 | trixie-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.2-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.1-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.2-1.pgdg11+1 | bullseye-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.1-1.pgdg11+1 | bullseye-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.2-1.pgdg26.04+1 | resolute-pgdg | amd64 pgbouncer-dbgsym | 1.25.1-1.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.2-1.pgdg25.10+1 | questing-pgdg | amd64 pgbouncer-dbgsym | 1.25.1-1.pgdg25.10+1 | questing-pgdg | amd64 pgbouncer-dbgsym | 1.25.2-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.1-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.2-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.25.1-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el The public mirrors serving apt.postgresql.org are synced hourly, the updated packages will be available there shortly.