← Vulnerability feed

Vulnerability record · CVE-2025-12819 · published 3 December 2025

CVE-2025-12819: Pgbouncer untrusted search path vulnerability

Pgbouncer · Pgbouncer

Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.

8.1 CVSS 3.1 High EPSS 0.36% · top 72.3% CWE-426 · Untrusted search path
8.1CVSS 3.1 base score
0.36%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.pgbouncer.org/changelog.html#pgbouncer-125x Release Notes
https://lists.debian.org/debian-lts-announce/2025/12/msg00033.html

Track CVE-2025-12819 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-6665Pgbouncer stack-based buffer overflow vulnerabilityThe SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-…EPSS 0.44%9.8CVE-2025-2291Pgbouncer vulnerabilityPassword can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to l…EPSS 0.36%8.1CVE-2021-3935Pgbouncer sql injection vulnerabilityWhen PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first e…EPSS 1.1%8.1CVE-2015-6817Pgbouncer improper authentication vulnerabilityPgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.EPSS 2.2%7.5CVE-2026-6666Pgbouncer null pointer dereference vulnerabilityA possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.EPSS 0.40%7.5CVE-2026-6664Pgbouncer integer overflow vulnerabilityAn integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated r…EPSS 0.73%7.5CVE-2015-4054Pgbouncer null pointer dereference vulnerabilityPgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before …EPSS 4.1%5.6CVE-2021-3672C-ares project c-ares cross-site scripting vulnerabilityA flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of …EPSS 2.8%

Source: NIST National Vulnerability Database (record CVE-2025-12819), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.