CVE-2026-107348: Integer Overflow or Wraparound in PgBouncer

This vulnerability involves an integer overflow in the mbuf_make_room function of PgBouncer's message buffer growth logic. When max_packet_size is set above 2^31 (2147483648), a packet header declaring a length above this threshold causes the buffer size calculation to overflow. This overflow leads to an infinite loop in the buffer growth logic, saturating a CPU core and stalling all client connections served by the single PgBouncer process. Since PgBouncer uses a single process to serve all clients, this results in a denial of service affecting all pooled connections. The overflow is exploitable before authentication starting from version 1.23.0, increasing the risk of exploitation.

The vulnerability causes a denial of service by saturating a CPU core and stalling all client connections until the PgBouncer process is restarted. There is no confidentiality or integrity impact reported. The attack requires a specially crafted packet with a header length above 2^31 and max_packet_size configured above 2147483648. The vulnerability is remotely exploitable without authentication from version 1.23.0 onward.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should avoid configuring max_packet_size above 2147483648 to prevent triggering the integer overflow. Monitor for updates from the PgBouncer project regarding an official fix.