PgBouncer 1.26.1 has been released. This release fixes three CVEs: 1. CVE-2026-107350: Authentication bypass, allowing a client that knows the password of one SCRAM user to log in as any other SCRAM user, including admins and backend superusers. Caused by a second StartupMessage being processed during SCRAM authentication when connecting to a non-existent database. 2. CVE-2026-107349: DoS due to infinite loop, triggerable by unauthenticated clients. Caused by an empty option name in the startup `options` parameter, when `ignore_startup_parameters` is non-empty but does not contain `options`. 3. CVE-2026-107348: DoS due to infinite loop, triggerable by unauthenticated clients. Caused by an integer overflow in the packet buffer growth logic, only when `max_packet_size` is set above its default.
It also makes `ignore_startup_parameters` take precedence over tracked parameters, so that `ignore_startup_parameters = search_path` restores the 1.25 behaviour of ignoring `search_path`. See [https://www.pgbouncer.org/2026/10/pgbouncer-1-26-1](https://www.pgbouncer.org/2026/10/pgbouncer-1-26-1) for more information, the detailed changelog, and download links.
