PT-2026-39228 · Pgbouncer · Pgbouncer

Harutokimura For · Published 2026-05-08 · Updated 2026-05-18 · CVE-2026-6666

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.2

Description A null pointer reference can occur in the kill pool logins server error() function if a server sends an error response that lacks the SQLSTATE field, potentially leading to a crash.

Recommendations Update to version 1.25.2 or later.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2026-06729

BIT-PGBOUNCER-2026-6666

CLEANSTART-2026-DL78780

CVE-2026-6666

Affected Products

Pgbouncer

References · 22

• https://nvd.nist.gov/vuln/detail/CVE-2026-6664 · Security Note
• https://bdu.fstec.ru/vul/2026-06729 · Security Note
• https://ubuntu.com/security/CVE-2026-6666 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-6666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6667 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-DL78780 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-6666 · Security Note
• https://osv.dev/vulnerability/BIT-pgbouncer-2026-6666 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-6666 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-6666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6665 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6666 · Security Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DL78780.json · Note
• https://t.me/cveNotify/162839 · Telegram Post
• https://twitter.com/eulerto/status/2053906834969247935 · Twitter Post