Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
References
Configurations
History
27 Dec 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 Dec 2025, 23:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.pgbouncer.org/changelog.html#pgbouncer-125x - Release Notes | |
| CPE | cpe:2.3:a:pgbouncer:pgbouncer:*:*:*:*:*:*:*:* | |
| First Time |
Pgbouncer
Pgbouncer pgbouncer |
03 Dec 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | (en) Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage. |
03 Dec 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-03 19:15
Updated : 2025-12-27 16:15
NVD link : CVE-2025-12819
Mitre link : CVE-2025-12819
CVE.ORG link : CVE-2025-12819
JSON object : View
Products Affected
pgbouncer
- pgbouncer
CWE
CWE-426
Untrusted Search Path