Loading vulnerability…
Stack-based buffer overflow in PgBouncer SCRAM authentication
CVE-2026-6665 is a stack-based buffer overflow in the SCRAM authentication code of PgBouncer versions before 1.25.2. PgBouncer incorrectly checks the return value of strlcat() when constructing the SCRAM client-final-message in a stack-allocated buffer. A malicious PostgreSQL backend can trigger the flaw by sending a SCRAM server-final-message containing an excessively long nonce, corrupting adjacent stack memory. Exploitation can cause denial of service and may permit arbitrary code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt PgBouncer's stack and crash the connection pooler, causing denial of service. A carefully crafted nonce may also enable control-flow hijacking and arbitrary code execution, depending on platform protections and stack layout.
If you can’t patch tonight, do this now.
Until patched, restrict PgBouncer backend connectivity to trusted PostgreSQL servers and enforce network segmentation and access controls. Monitor for malformed SCRAM authentication traffic and abnormal authentication activity. These measures reduce exposure but do not correct the buffer overflow.
Patch, then assume compromise.
Upgrade PgBouncer to version 1.25.2 or later. Fedora 43, 44, and 45 and Fedora EPEL 9, 10.2, and 10.4 have security updates targeting PgBouncer 1.26.0; deploy the applicable distribution package once approved and available. Where a patched distribution package is unavailable, building upstream PgBouncer 1.25.2 or later from source is an alternative.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.