CVE-2015-6817

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain...

8.1 HighFix available

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.16%Up 0.8 points since Feb 4, 2022

What each source reports

NVD Score used 8.1

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.

Record: CVE-2015-6817
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.

Record: CVE-2015-6817
Updated: 2026-11-02

EUVDEUVD-2015-6754 No score

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.

Record: EUVD-2015-6754
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hrw5-48mv-4v6h 8.1

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain...

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.

Record: GHSA-hrw5-48mv-4v6h
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287
Updated: 2026-11-02

OSV 8.1

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.

Record: CVE-2015-6817
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-6817 8.1

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.

Record: DEBIAN-CVE-2015-6817
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

pgbouncer

Affected packages

Affected packages
Package	Affected	Fixed
`pgbouncer` Debian:12	before 1.6.1-1	1.6.1-1
`pgbouncer` Debian:13	before 1.6.1-1	1.6.1-1
`pgbouncer` Debian:14	before 1.6.1-1	1.6.1-1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-6817 is a high vulnerability (CVSS 8.1) in Pgbouncer, published May 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in pgbouncer 1.6.1-1.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

In short

References