From: apt.postgresql.org Repository Update <noreply@postgresql.org>
To: PostgreSQL on Debian and Ubuntu <pgsql-pkg-debian@lists.postgresql.org>
Subject: pgbouncer updated to version 1.26.1-1.pgdg+1
Date: Mon, 19 Oct 2026 15:01:43 +0000
Message-ID: <E1xIorv-00000006cuQ-2QO3@atalia.postgresql.org> (raw)
The package pgbouncer was updated on apt.postgresql.org.
apt-listchanges: Changelogs
---------------------------
pgbouncer (1.26.1-1.pgdg+1) sid-pgdg; urgency=medium
* Rebuild for sid-pgdg.
* No source changes.
-- PostgreSQL on Debian and Ubuntu <pgsql-pkg-debian@lists.postgresql.org> Wed, 14 Oct 2026 12:55:24 +0200
pgbouncer (1.26.1-1) unstable; urgency=medium
* New upstream version 1.26.1.
* Fix CVE-2026-107350: PgBouncer 1.17.0 through 1.26.0 processed a second
StartupMessage sent during SCRAM authentication when the client
connected to a non-existent database. An attacker knowing the password
of a user listed in `auth_file` could use this to log in as any other
user that authenticates using SCRAM, including admins and backend
superusers. This requires SCRAM authentication to be used for both
users. The impersonated user can come from either `auth_file` or
`auth_query`.
* Fix CVE-2026-107349: An unauthenticated client could make PgBouncer
1.20.0 through 1.26.0 spin forever on a CPU core, and thus stop serving
all clients, by sending a startup `options` parameter containing an
empty option name such as `-c=`. This is only exploitable when
`ignore_startup_parameters` is non-empty but does not contain `options`.
* Fix CVE-2026-107348: An integer overflow in the packet buffer growth
logic of PgBouncer 1.21.0 through 1.26.0 could cause PgBouncer to hang
in an infinite loop when a client sent a packet header declaring a
length above 2^31. This is only exploitable when `max_packet_size` is
set to 2147483649 or higher, the default of 2147483647 is not affected.
Since 1.23.0 this is reachable before authentication. This is the same
class of bug as CVE-2026-6668, but in a different buffer implementation.
-- Christoph Berg <myon@debian.org> Wed, 14 Oct 2026 12:55:24 +0200
pgbouncer (1.26.0-6) unstable; urgency=medium
* Run a reduced smoke test set on buildd instead of the full upstream
suite. The timing- and load-sensitive tests kept failing on the slower
buildd architectures; the remaining tests cover the basic startup,
authentication and admin console paths and have been stable on all
architectures since 1.25.0-1. The full upstream suite can still be run
manually with "make check"; autopkgtest keeps its own connection test.
* Drop the now redundant test stabilization patches: test_notify_queue,
test-async-task-cleanup, test-flaky-timing-asserts, 1481.patch,
test-prepared-pipeline-stability, test-slow-arch-connect-timeout.
* debian/tests/connect: Drop "restart" test, it is unstable.
-- Christoph Berg <myon@debian.org> Thu, 01 Oct 2026 23:11:14 +0200
pgbouncer (1.26.0-5) unstable; urgency=medium
* Extend connection timeout for slow tests on riscv64.
-- Christoph Berg <myon@debian.org> Thu, 01 Oct 2026 12:33:14 +0200
New version 1.26.1-1.pgdg+1:
pgbouncer | 1.26.1-1.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el, source
pgbouncer | 1.26.0-4.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el, source
pgbouncer | 1.26.0-1.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el, source
pgbouncer | 1.26.1-1.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el, source
pgbouncer | 1.26.0-4.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el, source
pgbouncer | 1.26.0-1.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el, source
pgbouncer | 1.26.1-1.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el, source
pgbouncer | 1.26.0-4.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el, source
pgbouncer | 1.26.0-1.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el, source
pgbouncer | 1.26.1-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el, source
pgbouncer | 1.26.0-4.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el, source
pgbouncer | 1.26.0-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el, source
pgbouncer | 1.26.1-1.pgdg26.10+1 | stonking-pgdg | amd64, source
pgbouncer | 1.26.0-4.pgdg26.10+1 | stonking-pgdg | amd64, source
pgbouncer | 1.26.0-1.pgdg26.10+1 | stonking-pgdg | amd64, source
pgbouncer | 1.26.1-1.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el, source
pgbouncer | 1.26.0-4.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el, source
pgbouncer | 1.26.0-1.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el, source
pgbouncer | 1.26.1-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el, source
pgbouncer | 1.26.0-4.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el, source
pgbouncer | 1.26.0-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el, source
pgbouncer | 1.26.1-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el, source
pgbouncer | 1.26.0-4.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el, source
pgbouncer | 1.26.0-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el, source
pgbouncer-dbgsym | 1.26.1-1.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el
pgbouncer-dbgsym | 1.26.0-4.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el
pgbouncer-dbgsym | 1.26.0-1.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el
pgbouncer-dbgsym | 1.26.1-1.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el
pgbouncer-dbgsym | 1.26.0-4.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el
pgbouncer-dbgsym | 1.26.0-1.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el
pgbouncer-dbgsym | 1.26.1-1.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el
pgbouncer-dbgsym | 1.26.0-4.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el
pgbouncer-dbgsym | 1.26.0-1.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el
pgbouncer-dbgsym | 1.26.1-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el
pgbouncer-dbgsym | 1.26.0-4.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el
pgbouncer-dbgsym | 1.26.0-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el
pgbouncer-dbgsym | 1.26.1-1.pgdg26.10+1 | stonking-pgdg | amd64
pgbouncer-dbgsym | 1.26.0-4.pgdg26.10+1 | stonking-pgdg | amd64
pgbouncer-dbgsym | 1.26.0-1.pgdg26.10+1 | stonking-pgdg | amd64
pgbouncer-dbgsym | 1.26.1-1.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el
pgbouncer-dbgsym | 1.26.0-4.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el
pgbouncer-dbgsym | 1.26.0-1.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el
pgbouncer-dbgsym | 1.26.1-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el
pgbouncer-dbgsym | 1.26.0-4.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el
pgbouncer-dbgsym | 1.26.0-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el
pgbouncer-dbgsym | 1.26.1-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el
pgbouncer-dbgsym | 1.26.0-4.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el
pgbouncer-dbgsym | 1.26.0-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el
The public mirrors serving apt.postgresql.org are synced hourly,
the updated packages will be available there shortly.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-pkg-debian@postgresql.org
Cc: noreply@postgresql.org, pgsql-pkg-debian@lists.postgresql.org
Subject: Re: pgbouncer updated to version 1.26.1-1.pgdg+1
In-Reply-To: <E1xIorv-00000006cuQ-2QO3@atalia.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox