CVE-2026-6665 - Vulnerability Analysis

Overview

PgBouncer < 1.25.2 contains a buffer overflow caused by incorrect strlcat() return value check in SCRAM client-final-message construction, letting malicious backends trigger stack overflow, exploit requires malicious backend connection.

Severity & Score

Impact

Malicious backend can trigger stack overflow, potentially leading to denial of service or code execution.

Mitigation

Upgrade to version 1.25.2 or later.

References

• https://www.pgbouncer.org/changelog.html#pgbouncer-125x

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner