CVE-2021-3935: When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrar...

Security readout for executives and security teams

PgBouncer deployments using certificate authentication could let a network-positioned attacker inject SQL when a connection is first established. The issue undermines assumptions that TLS certificate verification alone protects this path. Exposure is limited to affected PgBouncer versions before 1.16.1 and the specific cert authentication configuration. Most likely exposure is PgBouncer used as a PostgreSQL connection pooler with cert authentication enabled, especially on networks where client-to-PgBouncer traffic could be intercepted. Environments not using PgBouncer, not using cert authentication, or already on fixed vendor packages are less likely exposed. Prioritize quickly for systems where PgBouncer fronts sensitive PostgreSQL databases and uses cert authentication. The risk is configuration-dependent, but arbitrary SQL injection in a database access layer can affect confidentiality and integrity. Mitigation focus: Upgrade PgBouncer to 1.16.1 or a vendor package containing the fix.; Apply relevant Fedora or Debian security updates if using those distributions.; Review PgBouncer authentication configuration for cert authentication usage..

Prepared

Jun 2, 2026, 17:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.