PostgreSQL PgBouncer up to 1.25.2 SCRAM Authentication resource consumption

Summaryinfo

A vulnerability described as problematic has been identified in PostgreSQL PgBouncer up to 1.25.2. Affected by this issue is some unknown functionality of the component SCRAM Authentication. Executing a manipulation can lead to resource consumption. This vulnerability is handled as CVE-2026-6669. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in PostgreSQL PgBouncer up to 1.25.2 and classified as problematic. This vulnerability affects an unknown code block of the component SCRAM Authentication. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.

The advisory is shared for download at pgbouncer.org. This vulnerability was named CVE-2026-6669 since 04/20/2026. The exploitation appears to be easy. The attack can be initiated remotely. The exploitation needs additional levels of successful authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-3529). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source PgBouncer

Productinfo

Type

• Database Software

Vendor

• PostgreSQL

Name

• PgBouncer

Version

• 1.25.0
• 1.25.1
• 1.25.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion