CVE catalog

CVE-2025-2291

pgbouncer: CVE-2025-2291

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.37% · Oct 25, 2026

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpgbouncersid1.26.1-1fixed
Debianpgbouncerforky1.26.1-1fixed
Debianpgbouncertrixie1.24.1-1+deb13u2fixed
Debianpgbouncerbookworm1.18.0-1+deb12u1fixed
Ubuntupgbouncer16.041.5.5-1vulnerable
Ubuntupgbouncer16.041.6.1-1vulnerable
Ubuntupgbouncer16.041.7-1vulnerable
Ubuntupgbouncer18.041.7.2-3build1vulnerable
Ubuntupgbouncer18.041.7.2-65-g2b8e6cf-1vulnerable
Ubuntupgbouncer18.041.8.1-1vulnerable
Ubuntupgbouncer18.041.8.1-1build1vulnerable
Ubuntupgbouncer20.041.10.0-1vulnerable
Ubuntupgbouncer20.041.10.0-1build1vulnerable
Ubuntupgbouncer20.041.11.0-1vulnerable
Ubuntupgbouncer20.041.12.0-2vulnerable
Ubuntupgbouncer20.041.12.0-3vulnerable
Ubuntupgbouncer22.041.15.0-1vulnerable
Ubuntupgbouncer22.041.16.1-1ubuntu1vulnerable
Ubuntupgbouncer24.041.20.0-1vulnerable
Ubuntupgbouncer24.041.21.0-1vulnerable
Ubuntupgbouncer24.041.22.0-1vulnerable
Ubuntupgbouncer24.041.22.0-1build1vulnerable
Ubuntupgbouncer24.041.22.0-1build3vulnerable
Ubuntupgbouncer24.041.22.0-1build4vulnerable
Ubuntupgbouncer25.101.24.0-3vulnerable
Ubuntupgbouncer25.101.24.1-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpgbouncersourcesid1.24.1-1not yet assignedNot reported[1103394]
Debianpgbouncersourceforky1.24.1-1not yet assignedNot reported[1103394]
Debianpgbouncersourcetrixie1.24.1-1not yet assignedNot reported[1103394]
Debianpgbouncersourcebookworm1.18.0-1+deb12u1not yet assignedNot reported[1103394]

[Debian bug #1103394]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [pgbouncer]Fixed
    Details (2)

    • 1.18.0-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.18.0-1+deb12u1

      dsa · pgbouncer · debian · bookworm; dsa · pgbouncer · debian · 12

    • 1.18.0-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.18.0-1+deb12u1

      dsa · pgbouncer · debian · bookworm; dsa · pgbouncer · debian · 12

[Debian 13 (Trixie)]

  • [pgbouncer]Fixed
    Details (2)

    • 1.24.1-1+deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.24.1-1

      dsa · pgbouncer · debian · 13

    • 1.24.1-1+deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.24.1-1

      dsa · pgbouncer · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]