CVE-2026-107349
Description
A flaw was found in PgBouncer. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending a startup message that contains an empty parameter name in its options. This causes PgBouncer to enter an infinite loop during startup parameter processing, consuming high CPU resources and rendering the service unresponsive to all clients until restarted.
Mitigation
Restrict network access to the PgBouncer service so that only trusted application hosts and administrative clients can connect. This can be accomplished by configuring firewall filtering using firewalld or by binding PgBouncer only to internal, isolated interfaces.
For example, to restrict access to PgBouncer (default port 6432/TCP) to a trusted subnet (such as 192.168.1.0/24):
1. Add a rich rule allowing only the trusted source subnet:
# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="6432" protocol="tcp" accept'
2. Ensure the port is not exposed in public zones:
# firewall-cmd --permanent --remove-port=6432/tcp
3. Reload firewalld to apply changes:
# firewall-cmd --reload
Caveats: Network-level restrictions reduce exposure to untrusted external clients but do not mitigate risks originating from compromised or untrusted hosts within the allowed network. Modifying firewall rules or listener configurations can momentarily disrupt active client sessions and connection pooling.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
