CVE-2026-6665 Details
Description
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
A stack overflow vulnerability has been identified in PgBouncer versions prior to 1.25.2, specifically within the SCRAM authentication process. The issue arises because the SCRAM code did not properly validate the return value of the strlcat() function when constructing the SCRAM client-final-message. This flaw can be exploited by a malicious backend that sends a SCRAM server-final-message containing a lengthy nonce.
Users can upgrade to PgBouncer version 1.25.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.pgbouncer.org/changelog.html#pgbouncer-125x | PostgreSQL | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | PostgreSQL |
Affected Products
| Product | Versions |
|---|---|
| pgbouncer pgbouncer | < 1.25.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | PostgreSQL |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 9, 2026 | New CVE Received | PostgreSQL |