Red Hat Security Advisory

RHSA-2026:83843

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-10-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images pgbouncer-1.26.1-1.hum1@aarch64, pgbouncer-1.26.1-1.hum1@s390x, pgbouncer-1.26.1-1.hum1@src +1

Fixes 3 records

TI-2026-74364 CVE-2026-107350

PgBouncer authentication bypass lets attackers log in as other users

MEDIUM 40

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer adm…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00369 Published 2026-10-14 Fixed in 1.26.1 CWE-287

TI-2026-74363 CVE-2026-107349

Infinite loop in PgBouncer startup options parameter handling

LOW 39

An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00404 Published 2026-10-14 Fixed in 1.26.1 CWE-400

TI-2026-74362 CVE-2026-107348

Integer overflow in PgBouncer buffer growth causes infinite loop

LOW 27

Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00392 Published 2026-10-14 Fixed in 1.26.1 CWE-190