CVE Catalog
CVE-2026-6666
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk0.37%
29th percentile - higher than 29% of all known CVEs
Summary
In PgBouncer before version 1.25.2, a null pointer dereference could cause a crash if a server sends an error response without the SQLSTATE field.
Risk Assessment
An attacker can remotely crash PgBouncer, leading to denial of service (DoS) and potential loss of database connections.
Recommendation
Immediately upgrade PgBouncer to version 1.25.2 or later.
Original NVD description (English source)
A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.