# CVE-2026-6666: PgBouncer null pointer dereference via malformed server error response

Source: https://junglewise.ai/threats/cve-2026-6666-pgbouncer-null-pointer-dereference-via-malformed-server-error  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-09. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-6666 · Severity: medium · CVSS 5.9 · Published 2026-05-09

PgBouncer is a popular connection pooler for PostgreSQL databases that helps manage large numbers of database connections efficiently. A vulnerability has been identified where a malicious or misconfigured database server can send a specific malformed error message that causes PgBouncer to crash. This results in a denial-of-service, preventing applications from connecting to their databases and potentially disrupting business operations.

Technologies: [PostgreSQL PgBouncer](https://junglewise.ai/threats/technologies/pgbouncer). Vendors: [PostgreSQL](https://junglewise.ai/threats/vendors/postgresql).

## Quick answers

**Is CVE-2026-6666 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6666 being exploited in the wild.

**How severe is CVE-2026-6666?** Medium severity, with a CVSS score of 5.9, published 9 May 2026.

**Which products and versions are affected?** PostgreSQL PgBouncer < 1.25.2, versions before 1.25.2.

**Is there a fix for CVE-2026-6666?** A patch was published on 2026-05-08: Fixed in PgBouncer version 1.25.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6666 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6666?** Check whether you run PostgreSQL PgBouncer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference vulnerability (CWE-476) exists in PgBouncer versions prior to 1.25.2. The issue occurs when PgBouncer processes an error response from a backend PostgreSQL server that lacks the expected SQLSTATE field. An attacker who can control or spoof a backend server's responses can trigger this condition to cause a daemon crash (Denial of Service). While the attack vector is network-based, it typically requires a high complexity (AC:H) as the attacker must be in a position to act as the backend server or compromise an existing one. The vulnerability is resolved in PgBouncer version 1.25.2.

## Affected products

- PostgreSQL PgBouncer < 1.25.2

## Timeline

- 2026-05-08: patched: Fixed in PgBouncer version 1.25.2
- 2026-05-09: disclosed: Initial NVD publication date

## References

- [https://www.pgbouncer.org/changelog.html](https://www.pgbouncer.org/changelog.html)

## Related threats

- [PgBouncer missing authorization for KILL_CLIENT admin command](https://junglewise.ai/threats/cve-2026-6667-pgbouncer-missing-authorization-for-kill-client-admin-command)
- [PgBouncer stack overflow in SCRAM authentication](https://junglewise.ai/threats/cve-2026-6665-pgbouncer-stack-overflow-in-scram-authentication)
- [PgBouncer integer overflow in SCRAM packet parsing](https://junglewise.ai/threats/cve-2026-6664-pgbouncer-integer-overflow-in-scram-packet-parsing)