← Vulnerability feed

Vulnerability record · CVE-2026-6665 · published 9 May 2026

CVE-2026-6665: Pgbouncer stack-based buffer overflow vulnerability

Pgbouncer · Pgbouncer

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.

9.8 CVSS 3.1 Critical EPSS 0.44% · top 64.0% CWE-121 · Stack-based buffer overflow
9.8CVSS 3.1 base score
0.44%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
24 Jul 2026Last modified by NVD

Description

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.pgbouncer.org/changelog.html#pgbouncer-125x Release Notes

Track CVE-2026-6665 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-2291Pgbouncer vulnerabilityPassword can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to l…EPSS 0.36%8.1CVE-2025-12819Pgbouncer untrusted search path vulnerabilityUntrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during …EPSS 0.36%8.1CVE-2021-3935Pgbouncer sql injection vulnerabilityWhen PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first e…EPSS 1.1%8.1CVE-2015-6817Pgbouncer improper authentication vulnerabilityPgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.EPSS 2.2%7.5CVE-2026-6666Pgbouncer null pointer dereference vulnerabilityA possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.EPSS 0.40%7.5CVE-2026-6664Pgbouncer integer overflow vulnerabilityAn integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated r…EPSS 0.73%7.5CVE-2015-4054Pgbouncer null pointer dereference vulnerabilityPgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before …EPSS 4.1%5.6CVE-2021-3672C-ares project c-ares cross-site scripting vulnerabilityA flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of …EPSS 2.8%

Source: NIST National Vulnerability Database (record CVE-2026-6665), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.