PT-2026-39227 · Pgbouncer · Pgbouncer

Harutokimura For · Published 2026-05-09 · Updated 2026-05-09 · CVE-2026-6665

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.2

Description The SCRAM code fails to correctly check the return value of the strlcat() function when constructing the SCRAM client-final-message. A malicious backend can trigger a stack overflow by sending a SCRAM server-final-message containing a long nonce.

Recommendations Update to version 1.25.2 or later.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-6665

Affected Products

Pgbouncer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-6665 · Security Note
• https://pgbouncer.org/changelog.html#pgbouncer-125x · Note
• https://twitter.com/VulmonFeeds/status/2053065304217964864 · Twitter Post