CVE-2026-6665 PUBLISHED

PgBouncer buffer overflow in SCRAM

Assigner: PostgreSQL
Reserved: 20.04.2026 Published: 09.05.2026 Updated: 09.05.2026

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	n/a
Product	PgBouncer
Versions	Default: unaffected affected from 0 to 1.25.2 (excl.)

Credits

Thanks to HarutoKimura for finding and reporting this problem. finder

References

https://www.pgbouncer.org/changelog.html#pgbouncer-125x

Problem Types

Stack-based Buffer Overflow CWE