CVE-2026-107349

Отчет

This vulnerability is rated as Important because PgBouncer can be rendered entirely unavailable by an unauthenticated remote client without requiring special privileges or prior authentication. Because PgBouncer serves pooled connections through a single process architecture, the resulting infinite loop monopolizes execution and prevents processing of any database traffic. The entire connection pool remains completely unresponsive until the daemon is manually restarted by an administrator.

Меры по смягчению последствий

Restrict network access to the PgBouncer service so that only trusted application hosts and administrative clients can connect. This can be accomplished by configuring firewall filtering using firewalld or by binding PgBouncer only to internal, isolated interfaces. For example, to restrict access to PgBouncer (default port 6432/TCP) to a trusted subnet (such as 192.168.1.0/24):

1. Add a rich rule allowing only the trusted source subnet:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="6432" protocol="tcp" accept'

2. Ensure the port is not exposed in public zones:

firewall-cmd --permanent --remove-port=6432/tcp

3. Reload firewalld to apply changes:

firewall-cmd --reload

Caveats: Network-level restrictions reduce exposure to untrusted external clients but do not mitigate risks originating from compromised or untrusted hosts within the allowed network. Modifying firewall rules or listener configurations can momentarily disrupt active client sessions and connection pooling.