This vulnerability involves an integer overflow or wraparound in PgBouncer's network packet parsing code prior to version 1.25.2. Specifically, a malformed SCRAM authentication packet can bypass boundary checks due to the overflow, leading to a crash of the PgBouncer process. The flaw can be triggered remotely without authentication, causing denial of service. The CVSS 3.1 base score is 7.5, reflecting high severity due to network attack vector, no privileges required, and no user interaction needed, with impact limited to availability.

An unauthenticated remote attacker can cause PgBouncer to crash by sending a specially crafted SCRAM authentication packet. This results in denial of service, disrupting database connection pooling and potentially impacting dependent applications. There is no indication of confidentiality or integrity compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as filtering or rate limiting SCRAM authentication packets to reduce exposure. Monitor for updates from PgBouncer maintainers regarding a security patch or official fix.