CVE-2026-6664
PgBouncer integer overflow in PgBouncer network packet parsing
CVE-2026-6664 is a high vulnerability (CVSS 7.5) in Pgbouncer, published May 9, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in pgbouncer 1.25.2-1.
- Severity
- 7.5 HighCVSS 3.1, CVE List
- Exploit chance
- 0.70%EPSS, 53rd percentile
- Exploitation
- None known1 public exploit
- Fixed in
1.25.2-1pgbouncer +12 more
Description
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pgbouncerAzure Linux:3 | before 1.25.2-1 | 1.25.2-1 |
pgbouncerBitnami | before 1.25.2 | 1.25.2 |
pgbouncerDebian:12 | All versions, plus listed versions 1.18.0-11.18.0-1+deb12u11.19.0-11.19.1-11.20.0-1 Show 17 moreShow less1.20.1-11.21.0-11.22.0-11.22.1-11.23.0-11.23.1-11.24.0-21.24.0-31.24.1-11.25.0-11.25.0-21.25.1-11.25.2-11.26.0-11.26.0-21.26.0-31.26.0-4 | None known |
pgbouncerDebian:13 | before 1.24.1-1+deb13u2, plus listed versions 1.24.1-11.24.1-1+deb13u1 | 1.24.1-1+deb13u2 |
pgbouncerDebian:14 | before 1.25.2-1, plus listed versions 1.24.1-11.25.0-11.25.0-21.25.1-1 | 1.25.2-1 |
pgbouncerUbuntu:16.04:LTS | All versions, plus listed versions 1.5.5-11.6.1-11.7-1 | None known |
pgbouncerUbuntu:18.04:LTS | All versions, plus listed versions 1.7.2-3build11.7.2-65-g2b8e6cf-11.8.1-11.8.1-1build1 | None known |
pgbouncerUbuntu:20.04:LTS | All versions, plus listed versions 1.10.0-11.10.0-1build11.11.0-11.12.0-21.12.0-3 | None known |
pgbouncerUbuntu:22.04:LTS | All versions, plus listed versions 1.15.0-11.16.1-1ubuntu1 | None known |
pgbouncerUbuntu:24.04:LTS | All versions, plus listed versions 1.20.0-11.21.0-11.22.0-11.22.0-1build11.22.0-1build31.22.0-1build4 | None known |
pgbouncerUbuntu:25.10 | All versions, plus listed versions 1.24.0-31.24.1-1 | None known |
pgbouncerUbuntu:26.10 | All versions, plus listed versions 1.25.1-11.25.2-11.25.2-1ubuntu1 | None known |
pgbouncerUbuntu:26.04:LTS | All versions, plus listed versions 1.24.1-11.25.0-21.25.1-1 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | nicolasjulian/bouncer-overflow | 2026-05-12 |
What each source reports
CVE List Score used
PgBouncer integer overflow in PgBouncer network packet parsing
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
- Record
CVE-2026-6664- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-28876
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
- Record
EUVD-2026-28876- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pmgp-q838-fh9g
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary...
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
- Record
GHSA-pmgp-q838-fh9g- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
- Record
CVE-2026-6664- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-6664
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
- Record
DEBIAN-CVE-2026-6664- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-6664
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
- Record
UBUNTU-CVE-2026-6664- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-86234No score
CVE-2026-6664 affecting package pgbouncer for versions less than 1.25.2-1
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
- Record
AZL-86234- Updated
- 2026-11-02
OSVBIT-pgbouncer-2026-6664No score
PgBouncer integer overflow in PgBouncer network packet parsing
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
- Record
BIT-pgbouncer-2026-6664- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.