CVE-2026-6664

7.5

HIGHCVSS v3

Published

May 9, 2026

Affected

7 projects

Assigned by

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Severity scale

010

Description

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.

pgbouncer/pgbouncer

GitHublightweight connection pooler for PostgreSQL

< 1.25.2NVD

bitnami/pgbouncer

Docker HubBitnami Secure Image for pgbouncer

< 1.25.2NVD

pgbouncer

Python Package Index

More on this CVE

NVD↗GitHub Advisory↗

Fixture to bring up temporary pgbouncer instance.

< 1.25.2NVD

pgbouncer

NPMWrapper of pgbouncer service

< 1.25.2NVD

Tabcorp/pgbouncer

GitHubNode wrapper for pgbouncer

< 1.25.2NVD

edoburu/pgbouncer

Docker HubMinimal PgBouncer image that is easy to configure

< 1.25.2NVD

pgbouncer

Debian Bookwormlightweight connection pooler for PostgreSQL

< 1.25.2NVD

Security Advisories

CVE-2026-6664

Description

More on this CVE