From: landry@openbsd.org
Subject: [update] pgbouncer 1.26 (with CVEs)
To: ports@openbsd.org, pea@openbsd.org, sthen@openbsd.org, naddy@openbsd.org
Date: Mon, 28 Sep 2026 16:39:52 +0200

hi,

small diff below cf
https://www.pgbouncer.org/changelog.html#pgbouncer-126x for CVEs

ok ? imo worth having in 8.0, but not a hill i'll die on.

Landry
? pgbouncer-1.22.1.diff
Index: Makefile
===================================================================
RCS file: /cvs/ports/databases/pgbouncer/Makefile,v
diff -u -r1.49 Makefile
--- Makefile	11 May 2026 12:19:58 -0000	1.49
+++ Makefile	28 Sep 2026 14:38:02 -0000
@@ -1,6 +1,6 @@
 COMMENT = 	lightweight connection pooler for PostgreSQL
 
-V = 		1.25.2
+V = 		1.26.0
 DISTNAME = 	pgbouncer-${V}
 
 CATEGORIES = 	databases
Index: distinfo
===================================================================
RCS file: /cvs/ports/databases/pgbouncer/distinfo,v
diff -u -r1.25 distinfo
--- distinfo	11 May 2026 12:19:58 -0000	1.25
+++ distinfo	28 Sep 2026 14:38:02 -0000
@@ -1,2 +1,2 @@
-SHA256 (pgbouncer-1.25.2.tar.gz) = kkrTURP9CnHI4tvoW10DRFUy4rezep+KSJg77qI4szI=
-SIZE (pgbouncer-1.25.2.tar.gz) = 865371
+SHA256 (pgbouncer-1.26.0.tar.gz) = r9Jd1h7md103tAYpuHzghzaz5pVfMFe7IS5BD78hxx0=
+SIZE (pgbouncer-1.26.0.tar.gz) = 897943
Index: patches/patch-etc_pgbouncer_ini
===================================================================
RCS file: /cvs/ports/databases/pgbouncer/patches/patch-etc_pgbouncer_ini,v
diff -u -r1.10 patch-etc_pgbouncer_ini
--- patches/patch-etc_pgbouncer_ini	3 Dec 2025 03:20:34 -0000	1.10
+++ patches/patch-etc_pgbouncer_ini	28 Sep 2026 14:38:02 -0000
@@ -1,7 +1,7 @@
 Index: etc/pgbouncer.ini
 --- etc/pgbouncer.ini.orig
 +++ etc/pgbouncer.ini
-@@ -155,6 +155,7 @@ auth_file = /etc/pgbouncer/userlist.txt
+@@ -157,6 +157,7 @@ auth_file = /etc/pgbouncer/userlist.txt
  
  ;; comma-separated list of users who are allowed to change settings
  ;admin_users = user2, someadmin, otheradmin
Index: patches/patch-lib_usual_tls_tls_compat_c
===================================================================
RCS file: patches/patch-lib_usual_tls_tls_compat_c
diff -N patches/patch-lib_usual_tls_tls_compat_c
--- patches/patch-lib_usual_tls_tls_compat_c	5 Dec 2025 17:07:06 -0000	1.1
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,23 +0,0 @@
-https://github.com/pgbouncer/pgbouncer/pull/1440
-
-Index: lib/usual/tls/tls_compat.c
---- lib/usual/tls/tls_compat.c.orig
-+++ lib/usual/tls/tls_compat.c
-@@ -438,13 +438,13 @@ int tls_asn1_parse_time(struct tls *ctx, const ASN1_TI
- 	*dst = 0;
- 	if (!asn1time)
- 		return 0;
--	if (asn1time->type != V_ASN1_GENERALIZEDTIME &&
--	    asn1time->type != V_ASN1_UTCTIME) {
--		tls_set_errorx(ctx, "Invalid time object type: %d", asn1time->type);
-+	if (ASN1_STRING_type(asn1time) != V_ASN1_GENERALIZEDTIME &&
-+	    ASN1_STRING_type(asn1time) != V_ASN1_UTCTIME) {
-+		tls_set_errorx(ctx, "Invalid time object type: %d", ASN1_STRING_type(asn1time));
- 		return -1;
- 	}
- 
--	res = asn1_time_parse((char *)asn1time->data, asn1time->length, &tm, 0);
-+	res = asn1_time_parse((const char *)ASN1_STRING_get0_data(asn1time), ASN1_STRING_length(asn1time), &tm, 0);
- 	if (res == -1) {
- 		tls_set_errorx(ctx, "Invalid asn1 time");
- 		return -1;
Index: patches/patch-lib_usual_tls_tls_conninfo_c
===================================================================
RCS file: patches/patch-lib_usual_tls_tls_conninfo_c
diff -N patches/patch-lib_usual_tls_tls_conninfo_c
--- patches/patch-lib_usual_tls_tls_conninfo_c	5 Dec 2025 17:07:06 -0000	1.1
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,17 +0,0 @@
-https://github.com/pgbouncer/pgbouncer/pull/1440
-
-Index: lib/usual/tls/tls_conninfo.c
---- lib/usual/tls/tls_conninfo.c.orig
-+++ lib/usual/tls/tls_conninfo.c
-@@ -132,9 +132,9 @@ static int tls_get_peer_cert_times(struct tls *ctx, ti
- 			goto err;
- 		if ((after = X509_get_notAfter(ctx->ssl_peer_cert)) == NULL)
- 			goto err;
--		if (asn1_time_parse((char *)before->data, before->length, &before_tm, 0) == -1)
-+		if (asn1_time_parse((const char *)ASN1_STRING_get0_data(before), ASN1_STRING_length(before), &before_tm, 0) == -1)
- 			goto err;
--		if (asn1_time_parse((char *)after->data, after->length, &after_tm, 0) == -1)
-+		if (asn1_time_parse((const char *)ASN1_STRING_get0_data(after), ASN1_STRING_length(after), &after_tm, 0) == -1)
- 			goto err;
- 		if ((*notbefore = timegm(&before_tm)) == -1)
- 			goto err;