CVE-2025-2291

Published: Apr 16, 2025Modified: Dec 8, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

Affected (2)

Products: Pgbouncer: Pgbouncer · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pgbouncer Pgbouncer	Before 1.24.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 11.0

Related CWEs

CWE-324

Use of a Key Past its Expiration Date

The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

References (2)

https://www.pgbouncer.org/changelog.html#pgbouncer-124x

Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Release Notes

https://lists.debian.org/debian-lts-announce/2025/05/msg00032.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.