Back Linuxsecurity

Fedora 43 pgbouncer Moderate Denial of Service Issues 2026

Linuxsecurity •LinuxSecurity Advisories • October 5, 2026

Share: View original

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

pgbouncer is a lightweight connection pooler for PostgreSQL and uses libevent

for low-level socket handling.

* Sat Sep 26 2026 Simone Caronni - 1.26.0-1 - Update to 1.26.0

[ 1 ] Bug #2476428 - CVE-2026-6665 pgbouncer: PgBouncer: Arbitrary code execution or Denial of Service via SCRAM server-final-message [epel-all] [ 2 ] Bug #2476429 - CVE-2026-6665 pgbouncer: PgBouncer: Arbitrary code execution or Denial of Service via SCRAM server-final-message [fedora-all] [ 3 ] Bug #2477907 - CVE-2026-6666 pgbouncer: PgBouncer: Denial of Service via malicious server error response [fedora-all] [ 4 ] Bug #2477908 - CVE-2026-6666 pgbouncer: PgBouncer: Denial of Service via malicious server error response [epel-all] [ 5 ] Bug #2477909 - CVE-2026-6664 pgbouncer: PgBouncer: Denial of Service via malformed SCRAM authentication packet [epel-all] [ 6 ] Bug...

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-6197f5c17e' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Flaws in PgBouncer Allow Remote Code Execution and Denial of Service Multiple vulnerabilities have been identified in PgBouncer, a lightweight connection pooler for PostgreSQL, affecting Fedora versions 43 to 45. The flaws, tracked as CVE-2026-6664, CVE-2026-6665, and CVE-2026-6666, could allow arbitrary code execution or denial of service via malicious SCRAM authentication packets. The vulnerabilities were disclosed on May 9, 2026, and have a CVSS score of 8.1 for CVE-2026-6665, marking it as a high severity issue. Users are advised to upgrade to PgBouncer version 1.26.0, which contains patches for these vulnerabilities. The updates were made available on September 26, 2026, and users are encouraged to apply them using the 'dnf' update program. Failure to address these vulnerabilities could expose systems to significant risks. 3 sources 73

Extracted Entities

Fedora 43 pgbouncer Moderate Denial of Service Issues 2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (3)

Platforms (1)