Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1xIos2-00000003ueE-475n for pgsql-pkg-debian@arkaria.postgresql.org; Mon, 19 Oct 2026 15:01:51 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xIorz-00000007exS-4Bnq for pgsql-pkg-debian@arkaria.postgresql.org; Mon, 19 Oct 2026 15:01:48 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1xIorz-00000007exJ-3D3w for pgsql-pkg-debian@lists.postgresql.org; Mon, 19 Oct 2026 15:01:47 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1xIorx-00000002zm3-2CKn for pgsql-pkg-debian@lists.postgresql.org; Mon, 19 Oct 2026 15:01:47 +0000 Received: from atalia.postgresql.org ([2001:4800:3e1:1::231]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1xIorw-00000008CEi-0WoI for pgsql-pkg-debian@lists.postgresql.org; Mon, 19 Oct 2026 15:01:44 +0000 Received: from aptuser by atalia.postgresql.org with local (Exim 4.98.2) (envelope-from ) id 1xIorv-00000006cuQ-2QO3 for pgsql-pkg-debian@lists.postgresql.org; Mon, 19 Oct 2026 15:01:43 +0000 From: apt.postgresql.org Repository Update To: PostgreSQL on Debian and Ubuntu Reply-To: PostgreSQL on Debian and Ubuntu Subject: pgbouncer updated to version 1.26.1-1.pgdg+1 Message-Id: Date: Mon, 19 Oct 2026 15:01:43 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk The package pgbouncer was updated on apt.postgresql.org. apt-listchanges: Changelogs --------------------------- pgbouncer (1.26.1-1.pgdg+1) sid-pgdg; urgency=medium * Rebuild for sid-pgdg. * No source changes. -- PostgreSQL on Debian and Ubuntu Wed, 14 Oct 2026 12:55:24 +0200 pgbouncer (1.26.1-1) unstable; urgency=medium * New upstream version 1.26.1. * Fix CVE-2026-107350: PgBouncer 1.17.0 through 1.26.0 processed a second StartupMessage sent during SCRAM authentication when the client connected to a non-existent database. An attacker knowing the password of a user listed in `auth_file` could use this to log in as any other user that authenticates using SCRAM, including admins and backend superusers. This requires SCRAM authentication to be used for both users. The impersonated user can come from either `auth_file` or `auth_query`. * Fix CVE-2026-107349: An unauthenticated client could make PgBouncer 1.20.0 through 1.26.0 spin forever on a CPU core, and thus stop serving all clients, by sending a startup `options` parameter containing an empty option name such as `-c=`. This is only exploitable when `ignore_startup_parameters` is non-empty but does not contain `options`. * Fix CVE-2026-107348: An integer overflow in the packet buffer growth logic of PgBouncer 1.21.0 through 1.26.0 could cause PgBouncer to hang in an infinite loop when a client sent a packet header declaring a length above 2^31. This is only exploitable when `max_packet_size` is set to 2147483649 or higher, the default of 2147483647 is not affected. Since 1.23.0 this is reachable before authentication. This is the same class of bug as CVE-2026-6668, but in a different buffer implementation. -- Christoph Berg Wed, 14 Oct 2026 12:55:24 +0200 pgbouncer (1.26.0-6) unstable; urgency=medium * Run a reduced smoke test set on buildd instead of the full upstream suite. The timing- and load-sensitive tests kept failing on the slower buildd architectures; the remaining tests cover the basic startup, authentication and admin console paths and have been stable on all architectures since 1.25.0-1. The full upstream suite can still be run manually with "make check"; autopkgtest keeps its own connection test. * Drop the now redundant test stabilization patches: test_notify_queue, test-async-task-cleanup, test-flaky-timing-asserts, 1481.patch, test-prepared-pipeline-stability, test-slow-arch-connect-timeout. * debian/tests/connect: Drop "restart" test, it is unstable. -- Christoph Berg Thu, 01 Oct 2026 23:11:14 +0200 pgbouncer (1.26.0-5) unstable; urgency=medium * Extend connection timeout for slow tests on riscv64. -- Christoph Berg Thu, 01 Oct 2026 12:33:14 +0200 New version 1.26.1-1.pgdg+1: pgbouncer | 1.26.1-1.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el, source pgbouncer | 1.26.0-4.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el, source pgbouncer | 1.26.0-1.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el, source pgbouncer | 1.26.1-1.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el, source pgbouncer | 1.26.0-4.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el, source pgbouncer | 1.26.0-1.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el, source pgbouncer | 1.26.1-1.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el, source pgbouncer | 1.26.0-4.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el, source pgbouncer | 1.26.0-1.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el, source pgbouncer | 1.26.1-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.26.0-4.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.26.0-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.26.1-1.pgdg26.10+1 | stonking-pgdg | amd64, source pgbouncer | 1.26.0-4.pgdg26.10+1 | stonking-pgdg | amd64, source pgbouncer | 1.26.0-1.pgdg26.10+1 | stonking-pgdg | amd64, source pgbouncer | 1.26.1-1.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.26.0-4.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.26.0-1.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.26.1-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.26.0-4.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.26.0-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.26.1-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.26.0-4.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el, source pgbouncer | 1.26.0-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el, source pgbouncer-dbgsym | 1.26.1-1.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el pgbouncer-dbgsym | 1.26.0-4.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el pgbouncer-dbgsym | 1.26.0-1.pgdg+1 | sid-pgdg | amd64, arm64, loong64, ppc64el pgbouncer-dbgsym | 1.26.1-1.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el pgbouncer-dbgsym | 1.26.0-4.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el pgbouncer-dbgsym | 1.26.0-1.pgdg14+1 | forky-pgdg | amd64, arm64, loong64, ppc64el pgbouncer-dbgsym | 1.26.1-1.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el pgbouncer-dbgsym | 1.26.0-4.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el pgbouncer-dbgsym | 1.26.0-1.pgdg13+1 | trixie-pgdg | amd64, arm64, loong64, ppc64el pgbouncer-dbgsym | 1.26.1-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.26.0-4.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.26.0-1.pgdg12+1 | bookworm-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.26.1-1.pgdg26.10+1 | stonking-pgdg | amd64 pgbouncer-dbgsym | 1.26.0-4.pgdg26.10+1 | stonking-pgdg | amd64 pgbouncer-dbgsym | 1.26.0-1.pgdg26.10+1 | stonking-pgdg | amd64 pgbouncer-dbgsym | 1.26.1-1.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.26.0-4.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.26.0-1.pgdg26.04+1 | resolute-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.26.1-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.26.0-4.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.26.0-1.pgdg24.04+1 | noble-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.26.1-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.26.0-4.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el pgbouncer-dbgsym | 1.26.0-1.pgdg22.04+1 | jammy-pgdg | amd64, arm64, ppc64el The public mirrors serving apt.postgresql.org are synced hourly, the updated packages will be available there shortly.