CVE-2026-6664 Details
Description
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
A vulnerability exists in PgBouncer versions prior to 1.25.2, where an integer overflow in the network packet parsing code can bypass a boundary check, potentially leading to a crash. This issue allows an unauthenticated remote attacker to cause a denial-of-service by sending a malformed SCRAM authentication packet.
Users can upgrade to PgBouncer version 1.25.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.pgbouncer.org/changelog.html#pgbouncer-125x | PostgreSQL | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | PostgreSQL |
Affected Products
| Product | Versions |
|---|---|
| pgbouncer pgbouncer | < 1.25.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | PostgreSQL |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 9, 2026 | New CVE Received | PostgreSQL |