CVE-2026-6665
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The SCRAM code in PgBouncer before version 1.25.2 does not correctly check the return value of strlcat() when building the client-final-message. A malicious backend sending a server-final-message with a long nonce can trigger a stack overflow.
Risk Assessment
An attacker controlling the database backend can crash PgBouncer via stack overflow, disrupting database connections.
Recommendation
Upgrade PgBouncer to version 1.25.2 or later, which fixes the strlcat() check.
Other vulnerabilities in PgBouncer
See all- CVE-2015-6817High
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
- CVE-2015-4054High
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.
- CVE-2026-6667Medium
PgBouncer before 1.25.2 did not properly authorize the KILL_CLIENT admin command. Any user with access to the admin console could run it, instead of only users in the admin_users list.
- CVE-2026-6666Medium
In PgBouncer before version 1.25.2, a null pointer dereference could cause a crash if a server sends an error response without the SQLSTATE field.
- CVE-2026-6664High
An integer overflow in network packet parsing in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
Original NVD description (English source)
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.