CVE-2026-6665 is a high severity (CVSS 8.1) stack overflow in PgBouncer's SCRAM code, fixed in PgBouncer 1.25.2. A malicious backend that sends a server final message with a long nonce can trigger it. Upgrade to 1.25.2 or later and make sure PgBouncer only connects to PostgreSQL servers you control.
What's affected
- Product: PgBouncer, the PostgreSQL connection pooler.
- Affected versions: before 1.25.2.
- Fixed version: 1.25.2, released 2026-05-08 per the PgBouncer changelog.
- Weakness: CWE-121 stack based buffer overflow. The code did not check the return value of strlcat() correctly while building the SCRAM client final message.
- Severity: CVSS 3.1 8.1, attack complexity high. The attacker must be, or stand in for, the backend server PgBouncer talks to.
- Same release: the changelog also lists fixes for CVE-2026-6664, CVE-2026-6666 and CVE-2026-6667.
How to check if you're exposed
Check the running version from the command line or from the admin console:
pgbouncer --version
SHOW VERSION;
The second command runs in the PgBouncer admin console. Distribution packages may use their own numbering, so compare against your vendor's security notice too.
Then list where PgBouncer connects. Each backend entry in the databases section of the configuration is a server that PgBouncer will authenticate against. If any of them is outside your control, or reachable over a network path that others can interfere with, the risk is higher.
What to do now
- Find every PgBouncer instance, including sidecars and containers.
- Upgrade to 1.25.2 or later, or to a distribution package that includes the fixes.
- Restart PgBouncer and confirm the version with SHOW VERSION.
- Review the backend list and remove servers you do not control.
- Use TLS with certificate verification on the PgBouncer to server connection.
Why it matters
The flaw is the reverse of what most people picture. The attacker is not a client sending bad data to the pooler. It is the server side of the connection, sending a SCRAM message with an oversized nonce. PgBouncer copied pieces into a fixed size stack buffer and ignored the signal that the buffer was too small.
That makes the preconditions demanding, which is why complexity is high. It also means that trust in your backends is part of the security model. A compromised database server, or one that someone can impersonate on the network, could target the pooler. The CISA KEV flag is false and the record reports no exploitation. The same release fixed an unauthenticated crash in packet parsing, so upgrading is worth doing for more than this one CVE.
Try it yourself
This walkthrough shows how a scan flags a component with a known fix and points to the version to move to.
Click through it at your own pace, or open it full screen.
Quick check
Can an ordinary client trigger this?
According to the record, no. It needs a malicious backend that sends a crafted SCRAM message.
What else is in 1.25.2?
The changelog lists a crash on a malformed SCRAM packet, a null pointer fix, and an authorization fix for the KILL_CLIENT admin command.
Sources
Last reviewed: 19 October 2026.
