CVE-2025-2291

Description

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

PUBLISHED Reserved 2025-03-13 | Published 2025-04-16 | Updated 2025-11-03 | Assigner PostgreSQL

Problem types

Use of a Key Past its Expiration Date

References

lists.debian.org/debian-lts-announce/2025/05/msg00032.html

www.pgbouncer.org/changelog.html

cve.org (CVE-2025-2291)

nvd.nist.gov (CVE-2025-2291)

Download JSON