CVE-2026-6669
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
PgBouncer through 1.25.2 lacks an upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server. A malicious or compromised PostgreSQL backend can cause uncontrolled CPU consumption in PgBouncer, and the key derivation cannot be interrupted in frontend builds.
Risk Assessment
Because PgBouncer serves all clients from a single process, one backend can stop it from serving traffic for every other database and client it pools, so the failure of a single backend is not contained.
Recommendation
Upgrade PgBouncer beyond 1.25.2 as soon as a fixed version is available, and consider limiting trust in PostgreSQL backends and monitoring CPU usage.
Other vulnerabilities in PgBouncer
See all- CVE-2015-6817High
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
- CVE-2015-4054High
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.
- CVE-2026-6668High
Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is killed. Both unauthenticated and authenticated code paths can reach the overflow.
- CVE-2026-19888High
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
- CVE-2026-6667Medium
PgBouncer before 1.25.2 did not properly authorize the KILL_CLIENT admin command. Any user with access to the admin console could run it, instead of only users in the admin_users list.
- CVE-2026-6666Medium
In PgBouncer before version 1.25.2, a null pointer dereference could cause a crash if a server sends an error response without the SQLSTATE field.
- CVE-2026-6665High
The SCRAM code in PgBouncer before version 1.25.2 does not correctly check the return value of strlcat() when building the client-final-message. A malicious backend sending a server-final-message with a long nonce can trigger a stack overflow.
- CVE-2026-6664High
An integer overflow in network packet parsing in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
Original NVD description (English source)
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS