{"id":"CVE-2026-107349","published":"2026-10-14T18:17:25.557","lastModified":"2026-10-16T21:17:18.340","description":"An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as \"-c=\", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400","CWE-835"],"vendors":[],"products":[],"references":[{"url":"https://www.pgbouncer.org/changelog.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}