CVE-2026-6668 in PgBouncer
Summary
by MITRE • 09/23/2026
Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is killed. Both unauthenticated and authenticated code paths can reach the overflow.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in PgBouncer versions through 1.25.2 represents a critical integer overflow flaw located within the packet buffer growth logic of the software. This defect allows an unauthenticated remote attacker to trigger a denial of service condition by exploiting how the application handles memory allocation for incoming network packets. The core technical issue arises when sufficiently large input data causes the calculation for the required buffer size to exceed the maximum value representable by the integer type used in the computation. Instead of handling this overflow gracefully or rejecting the oversized request, the flawed logic results in a significantly smaller allocated buffer than intended, which subsequently triggers an infinite growth loop as the system attempts repeatedly and unsuccessfully to accommodate the data within the incorrectly sized memory space.
From an operational perspective, the impact of this vulnerability is severe due to the architectural design of PgBouncer. As a connection pooler that serves all client connections from a single process rather than utilizing multi-threading or separate processes for each session, the consequences of resource exhaustion are immediate and widespread. When the integer overflow occurs, it leads to an infinite loop that saturates a CPU core completely. This saturation effectively stalls every pooled connection managed by that specific PgBouncer instance, rendering the service unavailable to all legitimate users connected through it. The only way to restore functionality is for an administrator or automated system to manually kill the affected process and restart the service, resulting in significant downtime and potential data loss if transactions are interrupted mid-flight.
The attack surface for this vulnerability includes both unauthenticated and authenticated code paths, meaning that even clients who have not yet established a full session can trigger the flaw during initial connection handling or protocol negotiation phases. This characteristic makes it particularly dangerous as it does not require valid credentials to exploit, allowing any remote actor with network access to disrupt service availability. The lack of authentication requirement lowers the barrier for entry significantly, enabling opportunistic attacks against systems that may have otherwise secure configurations regarding user permissions and access controls.
To mitigate this risk, organizations running PgBouncer must prioritize upgrading to version 1.25.3 or later where these integer overflow checks have been corrected. Until an upgrade is feasible, implementing network-level filtering rules can help restrict the size of incoming packets allowed through to the PgBouncer service, thereby preventing the specific large inputs that trigger the buffer growth loop from reaching the vulnerable code path. Additionally, deploying intrusion detection systems configured to monitor for abnormal CPU usage patterns or excessive connection attempts may provide early warning indicators of an active exploitation attempt against this vulnerability.
This flaw is categorized under CWE-190 Integer Overflow or Wraparound within standard classification frameworks, highlighting the fundamental programming error in handling numeric limits during memory allocation calculations. In terms of tactical behavior, it aligns with ATT&CK technique T1499 Endpoint Denial of Service, specifically reflecting methods that involve resource exhaustion to disrupt availability. Understanding these classifications aids security teams in mapping this specific technical defect to broader threat intelligence models and compliance requirements related to system resilience and secure coding practices.