Skip to content
OpenAdvisories
High RHSA-2026:83843 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Oct 18, 2026 · Updated Oct 18, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 pgbouncer 0:1.26.1-1.hum1

Vulnerabilities 3

  • High 8.8
    CVE-2026-107350

    Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer

    Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A seco…

    pgbouncer pgbouncer pgbouncer Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-107349

    Infinite loop on empty option name in startup options parameter in PgBouncer

    An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list look…

    pgbouncer pgbouncer pgbouncer Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2026-107348

    Integer overflow causes an infinite loop in message buffer growth in PgBouncer

    Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 ma…

    pgbouncer pgbouncer pgbouncer Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-107348
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-107349
  • report
    https://access.redhat.com/security/cve/CVE-2026-107350
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83843.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552741
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-107348
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-107348
  • article
    https://www.pgbouncer.org/changelog.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552735
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-107349
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-107349
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552733
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-107350
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-107350