CVE-2026-6665: Stack-based Buffer Overflow in PgBouncer
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
AI Analysis
Technical Summary
PgBouncer before version 1.25.2 contains a stack-based buffer overflow vulnerability in its SCRAM authentication code. Specifically, the code does not properly check the return value of strlcat() when building the SCRAM client-final-message. This flaw can be exploited by a malicious backend sending a SCRAM server-final-message containing an excessively long nonce, which causes a stack overflow condition.
Potential Impact
Successful exploitation of this vulnerability could lead to a stack-based buffer overflow, potentially allowing an attacker to execute arbitrary code, cause a denial of service, or crash the PgBouncer service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation level is currently confirmed for this vulnerability. Users should monitor the vendor advisory for updates and apply the official fix once it becomes available. Until then, consider restricting backend sources to trusted entities to reduce exposure.
CVE-2026-6665: Stack-based Buffer Overflow in PgBouncer
Description
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PgBouncer before version 1.25.2 contains a stack-based buffer overflow vulnerability in its SCRAM authentication code. Specifically, the code does not properly check the return value of strlcat() when building the SCRAM client-final-message. This flaw can be exploited by a malicious backend sending a SCRAM server-final-message containing an excessively long nonce, which causes a stack overflow condition.
Potential Impact
Successful exploitation of this vulnerability could lead to a stack-based buffer overflow, potentially allowing an attacker to execute arbitrary code, cause a denial of service, or crash the PgBouncer service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation level is currently confirmed for this vulnerability. Users should monitor the vendor advisory for updates and apply the official fix once it becomes available. Until then, consider restricting backend sources to trusted entities to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-04-20T12:25:43.793Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fe8c5ccbff5d86108b6aac
Added to database: 5/9/2026, 1:22:36 AM
Last enriched: 5/9/2026, 1:36:21 AM
Last updated: 5/9/2026, 2:40:12 AM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.