Is CVE-2026-6666 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6666 being exploited in the wild.

How severe is CVE-2026-6666?

Medium severity, with a CVSS score of 5.9, published 9 May 2026.

Which products and versions are affected?

PostgreSQL PgBouncer < 1.25.2, versions before 1.25.2.

Is there a fix for CVE-2026-6666?

A patch was published on 2026-05-08: Fixed in PgBouncer version 1.25.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6666 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6666?

Check whether you run PostgreSQL PgBouncer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6666: PgBouncer null pointer dereference via malformed server error response

Q: Is there a fix for CVE-2026-6666?

A patch was published on 2026-05-08: Fixed in PgBouncer version 1.25.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-6666 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-6666?

Check whether you run PostgreSQL PgBouncer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6666 · Severity: medium · CVSS 5.9 · Published 2026-05-09

PgBouncer is a popular connection pooler for PostgreSQL databases that helps manage large numbers of database connections efficiently. A vulnerability has been identified where a malicious or misconfigured database server can send a specific malformed error message that causes PgBouncer to crash. This results in a denial-of-service, preventing applications from connecting to their databases and potentially disrupting business operations.

Technologies: PostgreSQL PgBouncer. Vendors: PostgreSQL.

Quick answers

Is CVE-2026-6666 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6666 being exploited in the wild.
How severe is CVE-2026-6666?: Medium severity, with a CVSS score of 5.9, published 9 May 2026.
Which products and versions are affected?: PostgreSQL PgBouncer < 1.25.2, versions before 1.25.2.
Is there a fix for CVE-2026-6666?: A patch was published on 2026-05-08: Fixed in PgBouncer version 1.25.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6666 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6666?: Check whether you run PostgreSQL PgBouncer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference vulnerability (CWE-476) exists in PgBouncer versions prior to 1.25.2. The issue occurs when PgBouncer processes an error response from a backend PostgreSQL server that lacks the expected SQLSTATE field. An attacker who can control or spoof a backend server's responses can trigger this condition to cause a daemon crash (Denial of Service). While the attack vector is network-based, it typically requires a high complexity (AC:H) as the attacker must be in a position to act as the backend server or compromise an existing one. The vulnerability is resolved in PgBouncer version 1.25.2.

Affected products

PostgreSQL PgBouncer < 1.25.2

Timeline

2026-05-08: patched: Fixed in PgBouncer version 1.25.2
2026-05-09: disclosed: Initial NVD publication date

References

https://www.pgbouncer.org/changelog.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.