Public bug reported: Please sync pgbouncer 1.26.1-1 (universe) from Debian unstable (main)
Explanation of the Ubuntu delta and why it can be dropped: * d/p/openssl4.patch: Compatibility patch for OpenSSL 4 (LP: #2163692) The patch was merged upstream into pgbouncer version 1.26.0 [1], which fully resolves the Ubuntu delta. [1]: https://github.com/pgbouncer/pgbouncer/commit/564afdbc01293a6914b2a7e4301b9fd0d07f6469 Changelog entries since current tenacious version 1.25.2-1ubuntu1: pgbouncer (1.26.1-1) unstable; urgency=medium * New upstream version 1.26.1. * Fix CVE-2026-107350: PgBouncer 1.17.0 through 1.26.0 processed a second StartupMessage sent during SCRAM authentication when the client connected to a non-existent database. An attacker knowing the password of a user listed in `auth_file` could use this to log in as any other user that authenticates using SCRAM, including admins and backend superusers. This requires SCRAM authentication to be used for both users. The impersonated user can come from either `auth_file` or `auth_query`. * Fix CVE-2026-107349: An unauthenticated client could make PgBouncer 1.20.0 through 1.26.0 spin forever on a CPU core, and thus stop serving all clients, by sending a startup `options` parameter containing an empty option name such as `-c=`. This is only exploitable when `ignore_startup_parameters` is non-empty but does not contain `options`. * Fix CVE-2026-107348: An integer overflow in the packet buffer growth logic of PgBouncer 1.21.0 through 1.26.0 could cause PgBouncer to hang in an infinite loop when a client sent a packet header declaring a length above 2^31. This is only exploitable when `max_packet_size` is set to 2147483649 or higher, the default of 2147483647 is not affected. Since 1.23.0 this is reachable before authentication. This is the same class of bug as CVE-2026-6668, but in a different buffer implementation. -- Christoph Berg <[email protected]> Wed, 14 Oct 2026 12:55:24 +0200 pgbouncer (1.26.0-6) unstable; urgency=medium * Run a reduced smoke test set on buildd instead of the full upstream suite. The timing- and load-sensitive tests kept failing on the slower buildd architectures; the remaining tests cover the basic startup, authentication and admin console paths and have been stable on all architectures since 1.25.0-1. The full upstream suite can still be run manually with "make check"; autopkgtest keeps its own connection test. * Drop the now redundant test stabilization patches: test_notify_queue, test-async-task-cleanup, test-flaky-timing-asserts, 1481.patch, test-prepared-pipeline-stability, test-slow-arch-connect-timeout. * debian/tests/connect: Drop "restart" test, it is unstable. -- Christoph Berg <[email protected]> Thu, 01 Oct 2026 23:11:14 +0200 pgbouncer (1.26.0-5) unstable; urgency=medium * Extend connection timeout for slow tests on riscv64. -- Christoph Berg <[email protected]> Thu, 01 Oct 2026 12:33:14 +0200 pgbouncer (1.26.0-4) unstable; urgency=medium * Yet more tests stabilization. -- Christoph Berg <[email protected]> Tue, 29 Sep 2026 16:08:38 +0200 pgbouncer (1.26.0-3) unstable; urgency=medium * Further stabilize tests on 1-core machines, thanks to Santiago Vila for pointing out the issue. -- Christoph Berg <[email protected]> Tue, 29 Sep 2026 14:30:29 +0200 pgbouncer (1.26.0-2) unstable; urgency=medium * Stabilize tests by extending timeouts and reaping resources better. -- Christoph Berg <[email protected]> Mon, 28 Sep 2026 16:16:52 +0200 pgbouncer (1.26.0-1) unstable; urgency=medium [ Bradford D. Boyle ] * New upstream release. (Closes: #1148946) - Security * Fix CVE-2026-19888: PgBouncer before 1.26.0 did not check that the SCRAM client-final-message contained a nonce. An unauthenticated remote attacker could crash PgBouncer by sending a client-final-message without one. This also applies to users that do not exist, because PgBouncer runs a mock SCRAM exchange for those. This bug has existed since SCRAM support was added in PgBouncer 1.11.0. * Fix CVE-2026-6668: An integer overflow in the packet buffer growth logic of PgBouncer before 1.26.0 could cause PgBouncer to hang in an infinite loop. This required sending a large amount of data into a single packet buffer, which is possible without authenticating first when max_packet_size is left at its default value. Because PgBouncer is single-threaded, this hang stopped it from serving any clients until the process was killed. * Fix CVE-2026-6669: PgBouncer before 1.26.0 did not bound the SCRAM iteration count that it accepted from a server. A malicious or compromised PostgreSQL server could make PgBouncer perform an unbounded amount of work during a single login, stopping it from serving all other clients and databases in the meantime. The iteration count now has to be at most 1000000. - Features * Track all parameters that PostgreSQL reports by default. Most notably this means that search_path (on PostgreSQL 18 and above) and default_transaction_read_only (on PostgreSQL 14 and above) are now tracked by default. Previously a client running SET search_path or SET default_transaction_read_only = true in transaction pooling mode would affect other clients that later used the same server connection. (#1580, #1573) * Add pool_idle_timeout setting to clean up pools that have not been used for a while. This is useful in setups with many different users that connect infrequently. Without this setting enabled the number of pools grows without bound in such setups. The setting is disabled by default, because removing a pool also loses its statistics. (#1491) * Allow query_wait_timeout to be configured per user and per database. (#1449) * Add client_login_count stat to SHOW STATS, which counts successful client logins. This makes it possible to detect clients that churn connections. (#1457) * Send PgBouncer specific ParameterStatus messages to clients on login: pgbouncer.version, pgbouncer.pool_mode and pgbouncer.max_prepared_statements. This allows clients and drivers to detect that they are connected through PgBouncer and adapt their behaviour accordingly. (#1490) * Add login_notify_message setting. When set, its value is sent to clients as a NOTICE message after they log in. This can be used to make it clear to clients that they are connected through PgBouncer instead of directly to PostgreSQL. (#1488) * Add support for building PgBouncer with meson, including a Windows build using the UCRT64 environment. Autoconf builds continue to be supported. (#1524, #1426, #1568, #1585, #1602, #1607) * Add a logo. (#1609) - Changes * Remove the deprecated online restart (-R, aka takeover) functionality, together with the SHOW FDS and SUSPEND admin commands that only existed to support it. Use rolling restarts with so_reuseport instead. (#1581) * Increase the maximum length of passwords to 65535 bytes, matching libpq. (#1310, #1520) * Treat a NULL user name returned by auth_query the same as no rows being returned, instead of treating it as an error. (#1569) * Accept SET extra_float_digits on the admin database, which newer PostgreSQL JDBC drivers send during connection setup. (#1550) * Allow mkauth.py to write to stdout by passing - as the output file. (#1514) * Stop logging noisy errors on unexpected EOF from clients when built against OpenSSL 3. (#1507) * Include the underlying system error in TLS error messages when built against OpenSSL 3. (#1492) * Require a C11 compiler. (#1417) * Log which limit caused a server connection to be evicted. The disconnect reason is now evicted for max_db_connections, evicted for pool_size or evicted for max_user_connections instead of the bare evicted. (#1597) - Fixes * Fix late COPY messages causing pool exhaustion in transaction pooling mode. This also makes COPY work outside of an explicit transaction in transaction pooling mode. (#1471) * Fix LDAP authentication failures with long DNs by increasing the maximum LDAP URL length. (#1497) * Fix SCRAM pass-through corrupting the cached credentials of a forced user, which caused server logins to fail with the real server rejecting the SCRAM proof. (#1612) * Fix SCRAM pass-through failing with stored SCRAM secrets after a server reconnect, with the error "password is SCRAM secret but client authentication did not provide SCRAM keys". (#1504, bug introduced in 1.25.1) * Fix use-after-free crash when a replication client disconnects while its server connection is still logging in. (#1577) * Fix eviction of idle server connections for replication clients when the pool is full. Previously a single replication client could evict every idle server in the pool instead of just one, and no eviction happened at all when the pool held more servers than pool_size because of the reserve pool or cancel requests. (#1597) * Fix stalled TLS connections when a packet straddles the packet buffer boundary, for example a SET application_name with a long value. (#1531) * Fix prepared statement responses being sent in the wrong order when a batch mixes Parse and Close messages without a Sync in between. (#1555) * Fix parameters listed in track_extra_parameters that are not reported by the server causing incorrect behaviour when a client sets them in its startup packet. (#1576) * Fix login failures when the server splits its login packets across multiple TCP packets, for example when there is another proxy between PgBouncer and PostgreSQL. (#1446) * Fix query_timeout closing connections when no query was in flight. (#1395) * Fix sending a duplicate NegotiateProtocolVersion message when no server was available right away. (#1460) * Fix pool_size column in SHOW USERS showing a value for users that do not have one configured. (#1489) * Fix error message for ENABLE admin command. (#1308) * Fix compilation against future OpenSSL versions that make struct asn1_string_st opaque. (#1440) * Prevent the compiler from optimizing away the erasure of sensitive cryptographic data from the stack. (#1508) * Fix linking of pgbevent.dll with clang on Windows. (#1571) * Fix paths of root-level files in the release tarball, which were stored as pgbouncer-X.Y.Z/./configure instead of pgbouncer-X.Y.Z/configure. (#1549) * Fix a memory leak when reading track_extra_parameters from the config. (#1510) * Fix a memory leak for every startup packet that contained a protocol extension parameter (_pq_. prefix), which could be triggered by unauthenticated clients. (#1540) [ Brian Cosgrove ] * Replace the removed online restart option in the SysV init script with stop/start and document the change in NEWS. * Remove online restart from the package description. * Test connections after restart in autopkgtest. * Convert debian/copyright to machine-readable format. -- Bradford D. Boyle <[email protected]> Fri, 25 Sep 2026 10:41:27 +0200 ** Affects: pgbouncer (Ubuntu) Importance: Wishlist Status: New ** Changed in: pgbouncer (Ubuntu) Importance: Undecided => Wishlist -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172678 Title: Sync pgbouncer 1.26.1-1 (universe) from Debian unstable (main) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pgbouncer/+bug/2172678/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
