PT-2025-48983 · Pgbouncer+3 · Pgbouncer+3

Jason Tsang · Published 2025-12-03 · Updated 2026-02-09 · CVE-2025-12819

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.1

Description A flaw exists in PgBouncer’s authentication process due to an untrusted search path within the auth query connection handler. This allows an unauthenticated attacker to execute arbitrary SQL code during authentication by manipulating the search path parameter in the StartupMessage. The search path parameter is used to define the schema search order for database objects.

Recommendations Upgrade to PgBouncer version 1.25.1 or later.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

AZL-71249

AZL-71438

BDU:2025-15208

BIT-PGBOUNCER-2025-12819

CVE-2025-12819

DLA-4422-1

Affected Products

Alt Linux

Debian

Pgbouncer

Red Os

References · 35

• https://ubuntu.com/security/CVE-2025-12819 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15208 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-12819 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-12819 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-12819 · Security Note
• https://osv.dev/vulnerability/DLA-4422-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-pgbouncer-2025-12819 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12819 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-71438 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-12819 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-71249 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12819 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory