CVE-2025-2291

NameCVE-2025-2291
DescriptionPassword can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4180-1
Debian Bugs1103394

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pgbouncer (PTS)bookworm1.18.0-1+deb12u1fixed
trixie1.24.1-1+deb13u2fixed
forky, sid1.25.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pgbouncersourcebullseye1.15.0-1+deb11u1DLA-4180-1
pgbouncersourcebookworm1.18.0-1+deb12u1
pgbouncersource(unstable)1.24.1-11103394

Notes

Fixed by: https://github.com/pgbouncer/pgbouncer/commit/9912ee7f1af2e1b81d4d624a0da1cb49075ee78a (pgbouncer_1_24_1)
Search for package or bug name: Reporting problems