PgBouncer 1.26.1 fixes authentication bypass and two denial-of-service bugs

PgBouncer 1.26.1 fixes three security issues in the PostgreSQL connection pooler. One can let someone who knows one SCRAM user’s password authenticate as another when connecting to a nonexistent database. Two others can trap the process in infinite loops under specific startup-option or packet-size configurations. Review the release and upgrade affected deployments; the authentication issue does not require knowing the target user’s password.

PgBouncer · Oct 14, 2026

Why it matters

Connection pooling sits on the authentication boundary, so these fixes deserve operational attention.

More context

Review the release’s configuration conditions and test the upgrade. The packet-buffer issue requires max_packet_size above its default; the other loop involves ignore_startup_parameters. The release also adjusts precedence for ignored parameters.

Keep in mind

The three issues have different prerequisites; this summary does not imply every configuration is equally exposed.

Original read