CVE-2026-6665

8.1

High

Published:9 May 2026

Last updated:17 Jun 2026

Source:f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Analyzed

Weakness (CWE)

CWE-121Stack-based Buffer Overflow

CVSS Vector

v3.1

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

View on MITRE Find PoC on GitHub

Description

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.

References

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

https://www.pgbouncer.org/changelog.html#pgbouncer-125x