--- title: Nobody Patches the Pooler | daily.dev description: PgBouncer 1.26.0, released September 23, patches three CVEs, two of which can be triggered pre-authentication by anyone able to reach the listener over TCP.... canonical: https://daily.dev/posts/nobody-patches-the-pooler-rhxrdvmau twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Nobody Patches the Pooler | daily.dev og:description: PgBouncer 1.26.0, released September 23, patches three CVEs, two of which can be triggered pre-authentication by anyone able to reach the listener over TCP.... og:url: https://daily.dev/posts/nobody-patches-the-pooler-rhxrdvmau og:image: https://api.daily.dev/og/posts/RhxrDVMAu.png og:image:alt: Nobody Patches the Pooler og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Nobody Patches the Pooler **[Planet PostgreSQL](https://daily.dev/sources/planet-postgresql)** · 6 min read · 0 upvotes · 0 comments ## Summary PgBouncer 1.26.0, released September 23, patches three CVEs, two of which can be triggered pre-authentication by anyone able to reach the listener over TCP. CVE-2026-19888 is a NULL pointer dereference in SCRAM parsing present since SCRAM support was added in 1.11.0 (August 2019); omitting the client-final-message's r= attribute crashes the process. CVE-2026-6668 is an integer overflow in packet buffer growth that causes PgBouncer to hang forever rather than crash, silently freezing every client since it is single-threaded. CVE-2026-6669 involves a malicious upstream PostgreSQL server advertising an excessive SCRAM iteration count; 1.26.0 now caps it at 1,000,000. Because PgBouncer crashing causes all clients to reconnect simultaneously, it can trigger the exact connection storm it exists to prevent. The post argues PgBouncer is neglected because it isn't part of the regular PostgreSQL minor-version upgrade cadence, and urges immediate upgrade, noting removal of the deprecated -R online restart, SHOW FDS, and SUSPEND, plus a fix stopping search_path and default_transaction_read_only from leaking between clients in transaction pooling mode. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does CVE-2026-19888 in PgBouncer do and which versions are affected? CVE-2026-19888 is a NULL pointer dereference in PgBouncer's SCRAM-SHA-256 parser, present in every release since SCRAM support was added in 1.11.0 in August 2019. Omitting the r= nonce attribute from the client-final-message causes the parser to report success with a NULL nonce pointer, which crashes the process when dereferenced. It requires no valid credentials and no password, and is fixed in PgBouncer 1.26.0, released September 23. _Teams running PgBouncer in production can track CVE fixes like this one on daily.dev to stay ahead of pooler security debt._ ### Why would an integer overflow in PgBouncer cause a hang instead of a crash? CVE-2026-6668 is an integer overflow in the packet buffer growth logic, triggered by sending enough data into a single pre-authentication packet buffer so the size computation wraps and the growth loop never exits. Because PgBouncer is single-threaded, this pins a CPU core forever and freezes every client and server connection it fronts, without crashing or alerting systemd, until someone manually kills the process. It is fixed in version 1.26.0. _Developers debugging silent pooler freezes can follow writeups like this on daily.dev before it becomes a 3am page._ ### What breaking changes come with upgrading PgBouncer to 1.26.0? PgBouncer 1.26.0 removes the deprecated online restart mode (-R, also called takeover mode) along with the SHOW FDS and SUSPEND commands; deployments relying on -R need to switch to a rolling restart using so_reuseport. The release also makes PgBouncer track every parameter PostgreSQL reports by default, so search_path (on PostgreSQL 18) and default_transaction_read_only (on 14+) no longer leak between clients in transaction pooling mode, which could surface bugs in applications that depended on that leak. _Planning a PgBouncer upgrade with breaking changes in play is easier when daily.dev surfaces these migration details early._ ## Similar posts on daily.dev - [PgBouncer 1.26.0 released - Fixes three CVEs](https://daily.dev/posts/pgbouncer-1-26-0-released---fixes-three-cves-5uibkpxr4) · PostgreSQL · 0 upvotes · 0 comments - [PgBouncer 1.25.2 released](https://daily.dev/posts/pgbouncer-1-25-2-released-retovrcav) · PostgreSQL · 3 upvotes · 0 comments - [PostGREShell: A Decadelong PostgreSQL Vulnerability Revealed](https://daily.dev/posts/postgreshell-a-decadelong-postgresql-vulnerability-revealed-ewywwcoxd) · Medium · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#database](https://daily.dev/tags/database), [#postgresql](https://daily.dev/tags/postgresql) [View this post on daily.dev](https://daily.dev/posts/nobody-patches-the-pooler-rhxrdvmau) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Nobody Patches the Pooler","url":"https://daily.dev/posts/nobody-patches-the-pooler-rhxrdvmau","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/nobody-patches-the-pooler-rhxrdvmau"},"datePublished":"2026-10-02T18:30:49.495Z","dateModified":"2026-10-02T18:49:14.500Z","description":"PgBouncer 1.26.0, released September 23, patches three CVEs, two of which can be triggered pre-authentication by anyone able to reach the listener over TCP....","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"Planet PostgreSQL","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Planet PostgreSQL","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/planet-postgresql"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/nobody-patches-the-pooler-rhxrdvmau","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,database,postgresql","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Planet PostgreSQL","item":"https://daily.dev/sources/planet-postgresql"},{"@type":"ListItem","position":3,"name":"Nobody Patches the Pooler"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/nobody-patches-the-pooler-rhxrdvmau#faq","mainEntity":[{"@type":"Question","name":"What does CVE-2026-19888 in PgBouncer do and which versions are affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-19888 is a NULL pointer dereference in PgBouncer's SCRAM-SHA-256 parser, present in every release since SCRAM support was added in 1.11.0 in August 2019. Omitting the r= nonce attribute from the client-final-message causes the parser to report success with a NULL nonce pointer, which crashes the process when dereferenced. It requires no valid credentials and no password, and is fixed in PgBouncer 1.26.0, released September 23. Teams running PgBouncer in production can track CVE fixes like this one on daily.dev to stay ahead of pooler security debt."}},{"@type":"Question","name":"Why would an integer overflow in PgBouncer cause a hang instead of a crash?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-6668 is an integer overflow in the packet buffer growth logic, triggered by sending enough data into a single pre-authentication packet buffer so the size computation wraps and the growth loop never exits. Because PgBouncer is single-threaded, this pins a CPU core forever and freezes every client and server connection it fronts, without crashing or alerting systemd, until someone manually kills the process. It is fixed in version 1.26.0. Developers debugging silent pooler freezes can follow writeups like this on daily.dev before it becomes a 3am page."}},{"@type":"Question","name":"What breaking changes come with upgrading PgBouncer to 1.26.0?","acceptedAnswer":{"@type":"Answer","text":"PgBouncer 1.26.0 removes the deprecated online restart mode (-R, also called takeover mode) along with the SHOW FDS and SUSPEND commands; deployments relying on -R need to switch to a rolling restart using so_reuseport. The release also makes PgBouncer track every parameter PostgreSQL reports by default, so search_path (on PostgreSQL 18) and default_transaction_read_only (on 14+) no longer leak between clients in transaction pooling mode, which could surface bugs in applications that depended on that leak. Planning a PgBouncer upgrade with breaking changes in play is easier when daily.dev surfaces these migration details early."}}]} ```