PgBouncer 1.26.0 fixes three denial-of-service vulnerabilities

PgBouncer, the connection pooler that sits in front of PostgreSQL, has released version 1.26.0 with three denial-of-service fixes. Two problems can be triggered by unauthenticated clients; another involves excessive authentication work requested by a malicious database server. The release also changes connection-pool controls and removes the deprecated online restart option, so upgrades deserve an operational review.

PgBouncer · Sep 23, 2026

Why it matters

Connection pooling is part of your availability boundary, not merely a performance setting.

More context

Review the release notes and your restart procedure before upgrading a test deployment. New controls include pool_idle_timeout and per-user or per-database query_wait_timeout; default tracking now includes search_path.

Keep in mind

The announcement describes fixes, not evidence of exploitation at your installation. Removing the old -R restart mode may require deployment changes.

Original read