Executive brief
PgBouncer, a popular connection pooler for PostgreSQL databases, contains a security flaw in how it handles secure authentication. A malicious or compromised database server could send a specially crafted message to PgBouncer that causes the service to crash or potentially allows for unauthorized code execution. This could lead to a service outage or a compromise of the gateway that manages database traffic.
Technical details
A stack-based buffer overflow (CWE-121) exists in PgBouncer versions prior to 1.25.2. The vulnerability is located in the SCRAM authentication implementation, where the code fails to correctly validate the return value of the strlcat() function while constructing the 'client-final-message'. An attacker controlling a malicious backend database server can send a 'server-final-message' containing an excessively long nonce to trigger the overflow. While the attack requires a compromised or malicious backend (High Attack Complexity), it can result in a complete loss of availability or potential remote code execution on the PgBouncer host. The issue is resolved in version 1.25.2.
Affected products
- PostgreSQL PgBouncer < 1.25.2
Timeline
- 2026-05-08: patched: Fixed in PgBouncer 1.25.2
- 2026-05-09: disclosed: CVE published