Junglewise Threat Intelligence

CVE-2026-6666: PgBouncer null pointer dereference via malformed server error response

CVE-2026-6666 · Severity: medium · CVSS 5.9 · Published 2026-05-09

Technologies: PostgreSQL PgBouncer. Vendors: PostgreSQL.

Executive brief

PgBouncer is a popular connection pooler for PostgreSQL databases that helps manage large numbers of database connections efficiently. A vulnerability has been identified where a malicious or misconfigured database server can send a specific malformed error message that causes PgBouncer to crash. This results in a denial-of-service, preventing applications from connecting to their databases and potentially disrupting business operations.

Technical details

A NULL pointer dereference vulnerability (CWE-476) exists in PgBouncer versions prior to 1.25.2. The issue occurs when PgBouncer processes an error response from a backend PostgreSQL server that lacks the expected SQLSTATE field. An attacker who can control or spoof a backend server's responses can trigger this condition to cause a daemon crash (Denial of Service). While the attack vector is network-based, it typically requires a high complexity (AC:H) as the attacker must be in a position to act as the backend server or compromise an existing one. The vulnerability is resolved in PgBouncer version 1.25.2.

Affected products

  • PostgreSQL PgBouncer < 1.25.2

Timeline

  • 2026-05-08: patched: Fixed in PgBouncer version 1.25.2
  • 2026-05-09: disclosed: Initial NVD publication date

References

Related threats