Описание
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.
A flaw was found in PgBouncer. An integer overflow in the message buffer growth logic allows a remote attacker to cause a Denial of Service (DoS) when a large maximum packet size is configured. By sending a specially crafted packet header declaring an excessively large length, an attacker can trigger an infinite loop in the buffer calculation. Because PgBouncer handles connections in a single process, this loop consumes a full CPU core and halts all pooled connections until the process is restarted.
Меры по смягчению последствий
Ensure that max_packet_size is not configured above 2147483647 in the PgBouncer configuration file.
- Edit
/etc/pgbouncer/pgbouncer.iniand setmax_packet_sizeto a safe value (or remove the directive to use standard defaults):
- Reload the PgBouncer service to apply changes:
Warning: Reloading or restarting the service can disrupt ongoing administrative tasks or transient connections. Always schedule configuration reloads during standard maintenance windows.
3. Restrict network access:
Apply firewall rules to ensure that the PgBouncer listening port (default 6432) is accessible only by trusted application hosts and not exposed to untrusted networks.
Caveats: Setting max_packet_size to a lower threshold will reject legitimate queries or results exceeding that specified size.
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.
Integer overflow causes an infinite loop in message buffer growth in PgBouncer
Integer overflow in the message buffer growth logic (mbuf_make_room) i ...
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.
EPSS
5.9 Medium
CVSS3