8.1
High
CVE-2026-6665 The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the…
Description
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| pgbouncer 1.25 | earliest → < 1.25.2 | 1.25.2 |
Other CVEs of pgbouncer
The 13 CVEs of pgbouncer →
CVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user…
8.8
High
CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of…
7.5
High
CVE-2026-107348
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a…
5.9
Medium
CVE-2026-19888
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2…
7.5
High