Weak password requirements in PgBouncer



Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2025-2291
CWE-ID CWE-521
Exploitation vector Network
Public exploit N/A
Vulnerable software
 pgbouncer
Other software / Other software solutions

Vendor wiki.postgresql.org

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Weak password requirements

EUVDB-ID: #VU107593

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-2291

CWE-ID: CWE-521 - Weak Password Requirements

Exploit availability: No

Description

The vulnerability allows an attacker to gain unauthorized access to the application.

The vulnerability exists due to password can be used past its expiration as auth_query is not taking into account Postgre's VALID UNTIL value. An attacker with knowledge of an expired password can successfully login to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

pgbouncer: 1.0 - 1.24.0

CPE2.3 External links

https://www.pgbouncer.org/changelog.html#pgbouncer-124x


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###