CVE-2026-19888: NULL Pointer Dereference in PgBouncer
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
AI Analysis
Technical Summary
PgBouncer versions up to 1.25.2 contain a vulnerability in the SCRAM client-final-message parser due to missing validation of a mandatory attribute. An attacker can send a malformed message that causes the parser to report success while leaving a required value unset. This unset value is dereferenced as a NULL pointer, causing the PgBouncer process to crash. The crash occurs before any authentication check, so no valid credentials are needed. Because PgBouncer handles all client connections within a single process, this crash terminates all pooled connections, resulting in a denial of service.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by crashing the PgBouncer process, which terminates all client connections. There is no confidentiality or integrity impact reported. The attack requires no valid credentials and can disrupt availability for all clients using the PgBouncer instance.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting network access to PgBouncer to trusted clients only to reduce exposure.
CVE-2026-19888: NULL Pointer Dereference in PgBouncer
Description
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
CVSS v3.1
Score 7.5high
Affected software
PgBouncer
pkg:github/pgbouncer/pgbouncerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PgBouncer versions up to 1.25.2 contain a vulnerability in the SCRAM client-final-message parser due to missing validation of a mandatory attribute. An attacker can send a malformed message that causes the parser to report success while leaving a required value unset. This unset value is dereferenced as a NULL pointer, causing the PgBouncer process to crash. The crash occurs before any authentication check, so no valid credentials are needed. Because PgBouncer handles all client connections within a single process, this crash terminates all pooled connections, resulting in a denial of service.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by crashing the PgBouncer process, which terminates all client connections. There is no confidentiality or integrity impact reported. The attack requires no valid credentials and can disrupt availability for all clients using the PgBouncer instance.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting network access to PgBouncer to trusted clients only to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-08-14T16:55:37.365Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab3ff4ff7a7c541060b303c
Added to database: 09/23/2026, 16:33:19 UTC
Last enriched: 09/23/2026, 16:47:48 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.