PgBouncer before version 1.25.2 contains a stack-based buffer overflow vulnerability in its SCRAM authentication code. Specifically, the code does not correctly check the return value of strlcat() when building the SCRAM client-final-message. A malicious backend can exploit this by sending a SCRAM server-final-message containing an excessively long nonce, which triggers a stack overflow condition. This vulnerability affects the PgBouncer software and has a CVSS 3.1 base score of 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation level has been provided in the available data.

Successful exploitation of this vulnerability could allow a malicious backend to cause a stack overflow in PgBouncer, potentially leading to denial of service or arbitrary code execution. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.25.2, upgrading to version 1.25.2 or later is likely the intended remediation once officially released. Until then, monitor vendor communications for an official fix. No other specific mitigations are indicated in the available data.