CVE-2026-6669: Uncontrolled Resource Consumption in PgBouncer
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.
AI Analysis
Technical Summary
PgBouncer versions up to 1.25.2 have a vulnerability due to missing an upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend PostgreSQL server. A malicious or compromised backend can exploit this by specifying a very high iteration count, causing PgBouncer to consume excessive CPU resources. Because PgBouncer handles all client connections in a single process, this uncontrolled resource consumption can block PgBouncer from serving any other clients or databases, effectively causing a denial of service.
Potential Impact
The vulnerability results in high CPU consumption in PgBouncer, leading to denial of service for all clients and databases managed by the PgBouncer instance. There is no impact on confidentiality or integrity reported. The attack requires a malicious or compromised backend server. The CVSS v3.1 base score is 5.9 (medium severity), reflecting network attack vector with high attack complexity and no privileges required.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, limit trust in backend PostgreSQL servers and monitor backend behavior to detect abnormal resource consumption. Consider isolating PgBouncer instances or limiting backend server access to reduce risk.
CVE-2026-6669: Uncontrolled Resource Consumption in PgBouncer
Description
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.
CVSS v3.1
Score 5.9medium
Affected software
PgBouncer
pkg:github/pgbouncer/pgbouncerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PgBouncer versions up to 1.25.2 have a vulnerability due to missing an upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend PostgreSQL server. A malicious or compromised backend can exploit this by specifying a very high iteration count, causing PgBouncer to consume excessive CPU resources. Because PgBouncer handles all client connections in a single process, this uncontrolled resource consumption can block PgBouncer from serving any other clients or databases, effectively causing a denial of service.
Potential Impact
The vulnerability results in high CPU consumption in PgBouncer, leading to denial of service for all clients and databases managed by the PgBouncer instance. There is no impact on confidentiality or integrity reported. The attack requires a malicious or compromised backend server. The CVSS v3.1 base score is 5.9 (medium severity), reflecting network attack vector with high attack complexity and no privileges required.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, limit trust in backend PostgreSQL servers and monitor backend behavior to detect abnormal resource consumption. Consider isolating PgBouncer instances or limiting backend server access to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-04-20T12:25:47.129Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab3ff4ff7a7c541060b303e
Added to database: 09/23/2026, 16:33:19 UTC
Last enriched: 09/23/2026, 16:48:12 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.