PT-2026-39226 · Pgbouncer · Pgbouncer

Johannes Möller · Published 2026-05-08 · Updated 2026-05-20 · CVE-2026-6664

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.2

Description An integer overflow in the network packet parsing code allows an unauthenticated remote attacker to bypass a boundary check. By sending a malformed SCRAM authentication packet, the attacker can cause the system to crash, resulting in a denial of service.

Recommendations Update to version 1.25.2.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2026-06724

BIT-PGBOUNCER-2026-6664

CLEANSTART-2026-DL78780

CVE-2026-6664

Affected Products

Pgbouncer

References · 27

• https://nvd.nist.gov/vuln/detail/CVE-2026-6666 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-6664 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-DL78780 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-6664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6665 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-6664 · Security Note
• https://bdu.fstec.ru/vul/2026-06724 · Security Note
• https://osv.dev/vulnerability/BIT-pgbouncer-2026-6664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6664 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6667 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-6664 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-6664 · Vendor Advisory
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DL78780.json · Note
• https://twitter.com/CVEarity/status/2053328233056395385 · Twitter Post
• https://osv.dev/vulnerability/CVE-2026-6665 · Note