PgBouncer vulnerabilities
6 known CVE vulnerabilities in PgBouncer, translated and rated.
- CVE-2015-6817High
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
- CVE-2015-4054High
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.
- CVE-2026-6667Medium
PgBouncer before 1.25.2 did not properly authorize the KILL_CLIENT admin command. Any user with access to the admin console could run it, instead of only users in the admin_users list.
- CVE-2026-6666Medium
In PgBouncer before version 1.25.2, a null pointer dereference could cause a crash if a server sends an error response without the SQLSTATE field.
- CVE-2026-6665High
The SCRAM code in PgBouncer before version 1.25.2 does not correctly check the return value of strlcat() when building the client-final-message. A malicious backend sending a server-final-message with a long nonce can trigger a stack overflow.
- CVE-2026-6664High
An integer overflow in network packet parsing in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.