An integer overflow exists in the packet buffer growth logic of PgBouncer versions up to and including 1.25.2. When processing sufficiently large input, the calculation for buffer size overflows, causing the growth loop to become infinite. Since PgBouncer handles all client connections within a single process, this results in CPU core saturation and stalls all pooled connections, effectively causing a denial of service. Both unauthenticated and authenticated code paths can trigger this overflow.

The vulnerability allows remote unauthenticated attackers to cause a denial of service by exhausting CPU resources on the PgBouncer server. This stalls all client connections managed by the PgBouncer process until it is manually restarted or killed, disrupting service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of PgBouncer to untrusted networks and monitor for abnormal CPU usage that may indicate exploitation attempts.