pgbouncer (1.25.2-1) [PTS] [DDPO]

OK: VCS matches the version in the archive

Git: https://salsa.debian.org/postgresql/pgbouncer.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: master
Path: debian/changelog
Repo size: 266240
Browser: https://salsa.debian.org/postgresql/pgbouncer
Last scan: 2026-07-10 02:14:07+00
Next scan: 2026-07-16 22:06:00+00
CI pipeline status: success

Debian changelog in Git:

pgbouncer (1.25.2-1) unstable; urgency=medium

  [ Bradford D. Boyle ]
  * New upstream version 1.25.2.
    - Security
      * Fix CVE-2026-6664: An integer overflow in network packet parsing code
        in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a
        crash. An unauthenticated remote attacker can crash PgBouncer with a
        malformed SCRAM authentication packet.
      * Fix CVE-2026-6665: The SCRAM code in PgBouncer before 1.25.2 did not
        check the return value of strlcat() correctly when building the
        contents of the SCRAM client-final-message. A malicious backend that
        sends a SCRAM server-final-message with a long nonce can trigger a
        stack overflow.
      * Fix CVE-2026-6666: A possible null pointer reference in PgBouncer
        before 1.25.2 could lead to a crash, if a server sends an error
        response without SQLSTATE field.
      * Fix CVE-2026-6667: PgBouncer before 1.25.2 did not perform an
        appropriate authorization check for the KILL_CLIENT admin command. All
        users with access to the administration console (which itself requires
        authorization) could run this command. It would have been correct to
        allow only users listed in the admin_users parameter.
    - Fixes
      * Clarify documentation of default_pool_size parameter.
      * Correct documentation regarding client_tls13_ciphers and
        server_tls13_ciphers.

 -- Christoph Berg <myon@debian.org>  Sat, 09 May 2026 14:09:02 +0200

This branch is even with tag debian/1.25.2-1