CVE-2026-6668

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.

PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.

PgBouncer through 1.25.2 lacks an upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server. A malicious or compromised PostgreSQL backend can cause uncontrolled CPU consumption in PgBouncer, and the key derivation cannot be interrupted in frontend builds.

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.

PgBouncer before 1.25.2 did not properly authorize the KILL_CLIENT admin command. Any user with access to the admin console could run it, instead of only users in the admin_users list.

In PgBouncer before version 1.25.2, a null pointer dereference could cause a crash if a server sends an error response without the SQLSTATE field.

The SCRAM code in PgBouncer before version 1.25.2 does not correctly check the return value of strlcat() when building the client-final-message. A malicious backend sending a server-final-message with a long nonce can trigger a stack overflow.

An integer overflow in network packet parsing in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.