CVE-2026-6664 in PgBouncer
Summary
by MITRE • 05/09/2026
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/13/2026
The vulnerability under discussion represents a critical integer overflow condition within the network packet parsing functionality of PgBouncer, a widely-used connection pooler for PostgreSQL databases. This flaw exists in versions prior to 1.25.2 and specifically targets the handling of SCRAM authentication packets, which are part of the Secure Remote Password protocol designed to provide secure password authentication without transmitting passwords in clear text. The integer overflow occurs during the parsing process where the software fails to properly validate the size parameters of incoming authentication packets, creating a scenario where an attacker can manipulate packet dimensions to trigger unexpected behavior in the memory management system.
The technical exploitation of this vulnerability hinges on the manipulation of boundary checks that are intended to prevent buffer overflows and memory corruption. When PgBouncer processes a malformed SCRAM authentication packet, the integer overflow causes the boundary validation logic to be bypassed, allowing the program to continue processing data beyond allocated memory boundaries. This condition can result in memory corruption that manifests as program crashes or unexpected termination of the PgBouncer service. The vulnerability is particularly concerning because it does not require authentication credentials to exploit, making it accessible to any remote attacker who can establish network connectivity to the PgBouncer instance.
From an operational impact perspective, this vulnerability presents a significant risk to database availability and system stability. The ability to remotely crash PgBouncer with a single malformed packet means that an attacker can effectively perform a denial of service attack against database services that rely on this connection pooling mechanism. This disruption can cascade through entire database infrastructures, particularly in environments where PgBouncer serves as a critical component for managing database connections and where service availability is paramount. The vulnerability's impact extends beyond simple service interruption as it can potentially expose underlying system instability that might be exploited for more sophisticated attacks.
The mitigation strategy for this vulnerability centers on immediate patching of PgBouncer installations to version 1.25.2 or later, which contains the necessary fixes to properly handle integer overflow conditions in packet parsing. Organizations should also implement network-level controls to restrict access to PgBouncer instances and monitor for unusual authentication packet patterns that might indicate attempted exploitation. Additionally, implementing proper input validation and boundary checking mechanisms within the application code can help prevent similar vulnerabilities from manifesting in other components of the database infrastructure. This vulnerability aligns with CWE-190, which describes integer overflow conditions, and can be categorized under ATT&CK technique T1499.004 for network denial of service attacks, emphasizing the need for robust defensive measures in database security architectures.