CVE-2025-2291
CVE-2025-2291 · PgBouncer default auth_query does not take Postgres password expiry into account
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
CVSS 8.1 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
pgbouncer
- Versions
- ≥ 0, < 1.24.1: Affected (semver)
Update to 1.24.1
pgbouncer Debian:12
- Versions
- 1.18.0-1
- Affected ranges
- ECOSYSTEM: < 1.18.0-1+deb12u1
Update to 1.18.0-1+deb12u1
pgbouncer Debian:13
- Affected ranges
- ECOSYSTEM: < 1.24.1-1
Update to 1.24.1-1
pgbouncer Debian:14
- Affected ranges
- ECOSYSTEM: < 1.24.1-1
Update to 1.24.1-1
pgbouncer Ubuntu:16.04:LTS
- Versions
- 1.5.5-1
- 1.6.1-1
- 1.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pgbouncer Ubuntu:18.04:LTS
- Versions
- 1.7.2-3build1
- 1.7.2-65-g2b8e6cf-1
- 1.8.1-1
- 1.8.1-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pgbouncer Ubuntu:20.04:LTS
- Versions
- 1.10.0-1
- 1.10.0-1build1
- 1.11.0-1
- 1.12.0-2
- 1.12.0-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pgbouncer Ubuntu:22.04:LTS
- Versions
- 1.15.0-1
- 1.16.1-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pgbouncer Ubuntu:24.04:LTS
- Versions
- 1.20.0-1
- 1.21.0-1
- 1.22.0-1
- 1.22.0-1build1
- 1.22.0-1build3
- 1.22.0-1build4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pgbouncer Ubuntu:25.10
- Versions
- 1.24.0-3
- 1.24.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published