PgBouncer 1.25.1 released - Fixing a bunch of bugs before Christmas (including CVE-2025-12819)

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2025-12-03 00:00 UTC
  • Importiert: 2026-10-05 01:41 UTC
  • CVSS: 7.5
  • Quelle-ID: postgresql
  • uid_hash: f40116b8a1c0c2563a83f75b4501d16b7389ff4ff87b307573ce4d213b379516
PostgreSQL

Inhalt

PgBouncer 1.25.1 has been released. This release fixes CVE-2025-12819: Before this release it was possible for an unauthenticated attacker to execute arbitrary SQL during authentication by providing a malicious search_path parameter in the StartupMessage. Systems that have ALL the following configurations are vulnerable:

track_extra_parameters includes search_path (non-default configuration, probably only configured in setups involving Citus or PostgreSQL 18)

auth_user is set to a non-empty string (non-default configuration)

auth_query is configured without fully-qualified object names (default configuration, the < operator is not schema q

This release also fixes a bunch of bugs/issues introduced in the recent 1.25.0 release.

See the full details in the changelog.

Download here: pgbouncer-1.25.1.tar.gz (sha256)

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2025-12819

HIGH

7.5

HIGH

7.5

2025-12-03

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
PostgreSQL

postgresql

 vendor_advisory database - de https://www.postgresql.org/news/security.rss
Zurueck zur Eintrags-Liste