This vulnerability involves a null pointer dereference in PgBouncer versions prior to 1.25.2 triggered by receiving an error response without the SQLSTATE field from a server. The issue leads to a crash of the PgBouncer process, causing a denial of service condition. The CVSS 3.1 base score is 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. No patch or official remediation level has been documented yet.

Successful exploitation causes PgBouncer to crash, resulting in denial of service. There is no impact on confidentiality or integrity. The vulnerability does not require privileges or user interaction but has a high attack complexity, limiting exploitability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider monitoring PgBouncer stability and error responses from backend servers to detect potential triggers. Avoid relying on untrusted or malformed error responses if possible.