bouncer-overflow

PgBouncer Crash PoC This repository contains a local proof of concept for a PgBouncer crash caused by an integer overflow in vulnerable PgBouncer versions. The included Docker setup builds PgBouncer 1.25.1, starts a PostgreSQL backend, enables SCRAM-SHA-256 authentication, and runs poc.py against...

CVE-2026-6669 affecting package pgbouncer for versions less than 1.26.0-1

CVE-2026-6669 affecting package pgbouncer for versions less than 1.26.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-19888 affecting package pgbouncer for versions less than 1.26.0-1

CVE-2026-19888 affecting package pgbouncer for versions less than 1.26.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-6668 affecting package pgbouncer for versions less than 1.26.0-1

CVE-2026-6668 affecting package pgbouncer for versions less than 1.26.0-1. An upgraded version of the package is available that resolves this issue...

[SECURITY] Fedora 43 Update: pgbouncer-1.26.0-1.fc43

pgbouncer is a lightweight connection pooler for PostgreSQL and uses libevent for low-level socket handling...

[SECURITY] Fedora 44 Update: pgbouncer-1.26.0-1.fc44

pgbouncer is a lightweight connection pooler for PostgreSQL and uses libevent for low-level socket handling...

[SECURITY] Fedora 45 Update: pgbouncer-1.26.0-1.fc45

pgbouncer is a lightweight connection pooler for PostgreSQL and uses libevent for low-level socket handling...

Fedora 44 : pgbouncer (2026-99030761e8)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-99030761e8 advisory. Update to 1.26.0. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Fedora 45 : pgbouncer (2026-851c3ccde8)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-851c3ccde8 advisory. Update to 1.26.0. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Fedora 43 : pgbouncer (2026-6197f5c17e)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6197f5c17e advisory. Update to 1.26.0. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

BIT-PGBOUNCER-2026-6669 Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupte...

BIT-PGBOUNCER-2026-6668 Integer overflow causes an infinite loop in packet buffer growth in PgBouncer

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all...

BIT-PGBOUNCER-2026-19888 NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...

PT-2026-105128

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...

PT-2026-105129

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all...

PT-2026-105130

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupte...

Linux Distros Unpatched Vulnerability : CVE-2026-6668

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-19888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to...

The vulnerability of the SCRAM (Salted Challenge Response Authentication Mechanism) mechanism in the PostgreSQL PgBouncer connection pool allows a attacker to induce a service failure.

The vulnerability of the SCRAM Salted Challenge Response Authentication Mechanism mechanism in the PostgreSQL PgBouncer connection pool lies in the dereferencing of pointers due to the lack of validation for a required attribute in the end-message parser. Exploiting this vulnerability allows a...

The vulnerability of PostgreSQL PgBouncer’s connection pool software lies in the execution of an infinite loop when a condition for exiting the loop is not met. This allows a hacker to cause a service failure.

The vulnerability of the PostgreSQL PgBouncer connection pool software lies in the execution of a loop with an unreachable exit condition „Infinite loop“ due to a numerical overflow. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...