bouncer-overflow

PgBouncer Crash PoC This repository contains a local proof of concept for a PgBouncer crash caused by an integer overflow in vulnerable PgBouncer versions. The included Docker setup builds PgBouncer 1.25.1, starts a PostgreSQL backend, enables SCRAM-SHA-256 authentication, and runs poc.py against...

CVE-2026-112063

A flaw was found in libstrophe. A malicious XMPP Extensible Messaging and Presence Protocol server can exploit a stack-based buffer overflow in the SCRAM Salted Challenge Response Authentication Mechanism authentication handler by sending an oversized salt value. This issue allows an attacker to...

DEBIAN-CVE-2026-112063

libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAMHi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, abortin...

CVE-2026-112063

libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAMHi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, abortin...

CVE-2026-112063 libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi

libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAMHi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, abortin...

CVE-2026-112063

libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAMHi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, abortin...

CVE-2026-112063

The libstrophe library (through version 0.14.0 ) contains a stack-based buffer overflow vulnerability within the SCRAM_Hi function. This flaw occurs when an XMPP server sends a server-first-message containing an oversized SCRAM salt . If the s= attribute decodes to more than 124 bytes , it can ov...

CVE-2026-112063 libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi

libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAMHi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, abortin...

CVE-2026-112063: Stack-based Buffer Overflow

libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAMHi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, abortin...

PT-2026-116646

libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborti...

Strophe/Libstrophe buffer error vulnerability

Strophe libstrophe versions 0.14.0 and earlier have a buffer overflow vulnerability. This vulnerability stems from SCRAMHi’s handling of SCRAM salts, where a stack buffer overflow occurs when processing SCRAM salts. Malicious XMPP servers can exploit this vulnerability by sending SCRAM salts that...

Astra Linux – Vulnerability in dovecot

The attacker can use a specially crafted Base64 exchange between Dovecot and the client to forge SCRAM TLS channel bindings. This requires that the attacker be able to position themselves between Dovecot and the client connection. If successful, the attacker can eavesdrop on communications betwee...

CVE-2026-107350

A flaw was found in PgBouncer. An improper authentication vulnerability allows a remote attacker possessing valid credentials for any listed user to impersonate any other user configured with Salted Challenge Response Authentication Mechanism SCRAM, including PgBouncer administrators and backend...

CVE-2026-107350

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...

UBUNTU-CVE-2026-107350

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...

DEBIAN-CVE-2026-107350

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...

AZL-108189 CVE-2026-107350 affecting package pgbouncer 1.25.2-1

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...

CVE-2026-107350

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...

EUVD-2026-101500

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...

CVE-2026-107350

PgBouncer versions 1.17.0 through 1.26.0 are vulnerable to an authentication bypass during SCRAM authentication . An attacker who knows the password of a user listed in auth_file can log in as any other user, including PgBouncer admin users and backend superusers . The root cause is that the syst...