Loading vulnerability…
Unauthenticated denial of service in PgBouncer SCRAM packet parsing
CVE-2026-6664 is an integer overflow vulnerability in the network packet parsing code of PgBouncer versions before 1.25.2. A malformed SCRAM authentication packet can trigger the overflow, bypass a boundary check, and crash PgBouncer. The vulnerability is remotely exploitable without authentication or user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash PgBouncer and cause denial of service, interrupting connection-pooling availability. The demonstrated outcome is a PgBouncer crash; arbitrary code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, restrict access to the PgBouncer listening interface to trusted clients using network segmentation and access controls. Monitor or rate-limit abnormal SCRAM authentication activity and malformed protocol traffic. These measures reduce exposure but do not correct the integer overflow.
Patch, then assume compromise.
Upgrade PgBouncer to version 1.25.2 or later, or install the corresponding distribution security update. Fedora 43, 44, and 45 and EPEL 9, 10.2, and 10.4 updates provide PgBouncer 1.26.0; deploy the appropriate package once approved and available through the distribution update channel.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.