Loading story…
Microsoft disclosed two high-severity database-related vulnerabilities affecting PgBouncer and PostgreSQL, including CVE-2026-6665, a stack-based buffer overflow in PgBouncer's SCRAM authentication handling, and CVE-2026-6637, which affects PostgreSQL's refint component and can allow both a stack buffer overflow and SQL injection. The PgBouncer issue is classified as CWE-121 and carries a CVSS 8.1 score, indicating high potential impact to confidentiality, integrity, and availability.
According to Microsoft's advisory, CVE-2026-6665 is remotely reachable over the network, requires no privileges and no user interaction, though exploitation is assessed as having high attack complexity. The related PostgreSQL refint flaw broadens the risk profile by combining memory corruption with SQL injection exposure, raising concern for organizations running PostgreSQL environments directly or behind PgBouncer connection pooling layers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2026-6637 covering a PostgreSQL refint issue that allows stack buffer overflow and SQL injection. No additional synopsis details were provided in the reference.
Microsoft published a security notice for CVE-2026-6665 describing a stack-based buffer overflow in PgBouncer’s SCRAM handling. The advisory rates the flaw CVSS 8.1 and notes it is remotely reachable with no privileges or user interaction required, though exploitation has high attack complexity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
bugzilla.suse.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcesecurity-tracker.debian.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for two database-related vulnerabilities affecting **PostgreSQL** and **PgBouncer**, both tied to integer handling errors that can destabilize services. **CVE-2026-6473** describes a PostgreSQL server flaw in which allocations can be undersized because of integer wraparound, while **CVE-2026-6664** affects PgBouncer network packet parsing and is classified as an integer overflow issue under **CWE-190**. The PgBouncer flaw carries a **CVSS v3.1 score of 7.5** with vector `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, indicating a remotely exploitable issue that requires no privileges or user interaction and can cause a high availability impact, including denial of service. Microsoft released the PgBouncer notice on May 10 and later updated it, while the PostgreSQL advisory was published on May 16, signaling active vendor attention to memory-allocation and packet-parsing weaknesses in widely used database infrastructure components.
Jun 29, 2026
PostgreSQL released security updates for supported branches to fix multiple high-severity vulnerabilities affecting versions before **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**. The most serious issues include **CVE-2026-6473**, an integer wraparound bug that can cause undersized allocations and out-of-bounds writes, and **CVE-2026-6637**, a flaw in the `refint` module that can lead to a stack buffer overflow. In both cases, an unprivileged database user may be able to achieve arbitrary code execution as the operating system account running PostgreSQL. The `refint` issue also exposes a separate SQL injection path when applications use a user-controlled column as a `refint` cascade primary key and allow user-controlled updates, potentially enabling arbitrary SQL execution as the database user performing the update. Debian issued security advisories for **postgresql-15** and **postgresql-17**, and the Canadian Centre for Cyber Security urged administrators to review PostgreSQL’s advisory and deploy the patched releases **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**.
Jun 29, 2026
Researchers disclosed an **integer wraparound/overflow** flaw in PostgreSQL’s *libpq* client library (tracked as **CVE-2025-12818**) that can be triggered via the `PQescapeInternal` code path used by `PQescapeLiteral` and `PQescapeIdentifier`. When a crafted input string of certain lengths includes quotes and/or backslashes, *libpq* can miscalculate the required buffer size, allocate too little memory, and then perform an **out-of-bounds write by hundreds of megabytes**, typically resulting in a **segmentation fault (DoS)** in the consuming application. F5’s product advisories state that PostgreSQL versions prior to **18.1, 17.7, 16.11, 15.15, 14.20, and 13.23** are affected by CVE-2025-12818, but report **no impact to F5 products** after evaluation. Separate F5 advisories published alongside this disclosure cover unrelated issues, including a PostgreSQL authorization/DoS issue in `CREATE STATISTICS` (**CVE-2025-12817**), a curl cross-protocol redirect token-leak issue (**CVE-2025-14524**), an Apache Solr *create core* input-validation/allowPaths bypass with potential NTLM hash disclosure on Windows (**CVE-2026-22444**), and a local privilege-escalation issue in the Intel 800 Series Ethernet Linux driver affecting certain F5 appliance lines (**CVE-2025-24325**).
Jun 29, 2026