Executive brief
PgBouncer, a popular connection pooler for PostgreSQL databases, is vulnerable to a flaw that allows an attacker to crash the service remotely. By sending a specially crafted authentication packet, an unauthenticated user can trigger a system failure, leading to a denial of service for all applications relying on the database connection pool. This can disrupt business operations and prevent legitimate users from accessing database resources.
Technical details
An integer overflow vulnerability exists in the network packet parsing logic of PgBouncer versions prior to 1.25.2. The flaw is located within the code responsible for handling SCRAM authentication packets, where an integer overflow allows an attacker to bypass a boundary check. A remote, unauthenticated attacker can exploit this by sending a malformed SCRAM authentication packet, resulting in a daemon crash (Denial of Service). The vulnerability is tracked as CWE-190. Users should upgrade to PgBouncer version 1.25.2 or later to resolve the issue.
Affected products
- PostgreSQL PgBouncer before 1.25.2
Timeline
- 2026-05-08: patched: PgBouncer version 1.25.2 released
- 2026-05-09: disclosed: CVE-2026-6664 published