CVE-2026-6664

Description

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.

PUBLISHED Reserved 2026-04-20 | Published 2026-05-09 | Updated 2026-05-09 | Assigner PostgreSQL

Problem types

Integer Overflow or Wraparound

Credits

Thanks to Johannes Möller for finding and reporting this problem. finder

References

www.pgbouncer.org/changelog.html

cve.org (CVE-2026-6664)

nvd.nist.gov (CVE-2026-6664)

Download JSON