CVE-2026-6665
PgBouncer buffer overflow in SCRAM
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
PgBouncer buffer overflow in SCRAM
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
- Record
CVE-2026-6665- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
EUVDEUVD-2026-28877
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
- Record
EUVD-2026-28877- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mhmx-mjv6-w337
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly...
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
- Record
GHSA-mhmx-mjv6-w337- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
NVD
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
- Record
CVE-2026-6665- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-6665
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
- Record
DEBIAN-CVE-2026-6665- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-6665
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
- Record
UBUNTU-CVE-2026-6665- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-86237 No score
CVE-2026-6665 affecting package pgbouncer for versions less than 1.25.2-1
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
- Record
AZL-86237- Updated
- 2026-11-02
OSVBIT-pgbouncer-2026-6665 No score
PgBouncer buffer overflow in SCRAM
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
- Record
BIT-pgbouncer-2026-6665- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pgbouncerAzure Linux:3 |
before 1.25.2-1 | 1.25.2-1 |
pgbouncerBitnami |
before 1.25.2 | 1.25.2 |
pgbouncerDebian:12 |
All versions, plus listed versions 1.18.0-11.18.0-1+deb12u11.19.0-11.19.1-11.20.0-1 Show 17 moreShow less1.20.1-11.21.0-11.22.0-11.22.1-11.23.0-11.23.1-11.24.0-21.24.0-31.24.1-11.25.0-11.25.0-21.25.1-11.25.2-11.26.0-11.26.0-21.26.0-31.26.0-4 |
None known |
pgbouncerDebian:13 |
before 1.24.1-1+deb13u2, plus listed versions 1.24.1-11.24.1-1+deb13u1 |
1.24.1-1+deb13u2 |
pgbouncerDebian:14 |
before 1.25.2-1, plus listed versions 1.24.1-11.25.0-11.25.0-21.25.1-1 |
1.25.2-1 |
pgbouncerUbuntu:16.04:LTS |
All versions, plus listed versions 1.5.5-11.6.1-11.7-1 |
None known |
pgbouncerUbuntu:18.04:LTS |
All versions, plus listed versions 1.7.2-3build11.7.2-65-g2b8e6cf-11.8.1-11.8.1-1build1 |
None known |
pgbouncerUbuntu:20.04:LTS |
All versions, plus listed versions 1.10.0-11.10.0-1build11.11.0-11.12.0-21.12.0-3 |
None known |
pgbouncerUbuntu:22.04:LTS |
All versions, plus listed versions 1.15.0-11.16.1-1ubuntu1 |
None known |
pgbouncerUbuntu:24.04:LTS |
All versions, plus listed versions 1.20.0-11.21.0-11.22.0-11.22.0-1build11.22.0-1build31.22.0-1build4 |
None known |
pgbouncerUbuntu:25.10 |
All versions, plus listed versions 1.24.0-31.24.1-1 |
None known |
pgbouncerUbuntu:26.10 |
All versions, plus listed versions 1.25.1-11.25.2-11.25.2-1ubuntu1 |
None known |
pgbouncerUbuntu:26.04:LTS |
All versions, plus listed versions 1.24.1-11.25.0-21.25.1-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-6665 is a high vulnerability (CVSS 8.1) in Pgbouncer, published May 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in pgbouncer 1.25.2-1.