169 matches found
bouncer-overflow
PgBouncer Crash PoC This repository contains a local proof of concept for a PgBouncer crash caused by an integer overflow in vulnerable PgBouncer versions. The included Docker setup builds PgBouncer 1.25.1, starts a PostgreSQL backend, enables SCRAM-SHA-256 authentication, and runs poc.py against...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146976)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146976 advisory. A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce...
pgbouncer: pgbouncer: Privilege escalation via secondary startup message during SCRAM authentication
A flaw was found in PgBouncer. An improper authentication vulnerability allows a remote attacker possessing valid credentials for any listed user to impersonate any other user configured with Salted Challenge Response Authentication Mechanism SCRAM, including PgBouncer administrators and backend...
Astra Linux – Vulnerability in dovecot
The attacker can use a specially crafted Base64 exchange between Dovecot and the client to forge SCRAM TLS channel bindings. This requires that the attacker be able to position themselves between Dovecot and the client connection. If successful, the attacker can eavesdrop on communications betwee...
Linux Distros Unpatched Vulnerability : CVE-2026-106428
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed...
CVE-2026-106428
A flaw was found in the MongoDB C Driver. An out-of-bounds read occurs when the driver parses malformed responses during Salted Challenge Response Authentication Mechanism SCRAM authentication. A malicious server or network intermediary can exploit this flaw by sending a crafted response before...
DEBIAN-CVE-2026-106428
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...
CVE-2026-106428
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...
CVE-2026-106428
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...
CVE-2026-106428
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...
EUVD-2026-95144
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...
PT-2026-108134
Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description An out-of-bounds read occurs during SCRAM authentication response parsing when the driver processes a malformed server-final message. This allows the system to read one byte beyond a...
RHLW-2026-5920E9C5F3ADA010 Lightwell Security Advisory: postgresql 42.7.3.rhlw-00001
Red Hat Lightwell has released org.postgresql:postgresql 42.7.3.rhlw-00001 with a backported security fix. CVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS This patched artifact is a drop-in replacement for org.postgresql:postgresql 42.7.3 from...
CVE-2026-106428: Out-of-bounds Read
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...
RHLW-2026-B44D1F7DAC7A0D3D Lightwell Security Advisory: postgresql 42.3.3.rhlw-00006
Red Hat Lightwell has released org.postgresql:postgresql 42.3.3.rhlw-00006 with backported fixes for CVE-2022-31197, CVE-2022-41946, CVE-2024-1597, and CVE-2026-42198. CVE-2022-31197: SQL Injection in ResultSet.refreshRow with malicious column names in pgjdbc CVE-2022-41946: TemporaryFolder on...
ROS-20261002-73-0109
The vulnerability of the SCRAM authentication subsystem in the PostgreSQL database management system is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker to disclose sensitive information...
ROS-20261002-73-0111
The vulnerability of the SCRAM authentication subsystem in the PostgreSQL database management system is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker to disclose sensitive information...
ROS-20261002-73-0110
The vulnerability of the SCRAM authentication subsystem in the PostgreSQL database management system is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker to disclose sensitive information...
BIT-PGBOUNCER-2026-6669 Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupte...
PT-2026-105130
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupte...