2 results · Clear filters · Feed
-
Medium 4.3
PgBouncer missing authorization check in KILL_CLIENT admin command
PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow…
-
Medium 5.9CVE-2026-6666 Public exploit
PgBouncer crash in kill_pool_logins_server_error
A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.