CVE-2025-2291 json
PgBouncer default auth_query does not take Postgres password expiry into account
published last yr. modified 2mo ago also BIT-pgbouncer-2025-2291 , EUVD-2025-11379
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
Patch / fix
- bitnami pgbouncer 1.24.1
- n/a PgBouncer 1.24.1
- pgbouncer Debian 12 1.18.0-1+deb12u1
- pgbouncer Debian 14, Debian 13 1.24.1-1
debian advisories DEBIAN-CVE-2025-2291
- pgbouncer CBL-Mariner 2.0, Azure Linux 3.0 1.24.1-1
azure linux advisories AZL-60437AZL-60438
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Is CVE-2025-2291 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | pgbouncer | <1.24.1 |
1.24.1 |
Affected products
- n/a PgBouncer
Classification
- Weakness
-
- CWE-324 Use of a Key Past its Expiration Date
References
-
pgbouncer.org
/changelog.html#pgbouncer-124x
release-notes, article
-
lists.debian.org
/debian-lts-announce/2025/05/msg00032.html
mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-2291
web
Sources
- CVE List CVE-2025-2291
- NVD CVE-2025-2291
- OSV BIT-pgbouncer-2025-2291
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.