CVE-2026-19888: NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker only needs network access to the PgBouncer service and the ability to send a malformed SCRAM client-final message. No valid credentials or authenticated account are required because the crash happens before credential verification.
What is the operational impact of a successful attack?
The PgBouncer process crashes, terminating every pooled connection served by that process. This is an availability issue; the provided data does not indicate confidentiality or integrity impact.
Which deployments should be considered affected?
PgBouncer versions through 1.25.2 are affected when exposed to clients that can initiate SCRAM authentication. The provided information does not specify whether any particular default authentication configuration enables or prevents exploitation.
How can I tell whether an outage may be caused by this vulnerability?
Investigate PgBouncer process crashes occurring during SCRAM authentication handling, especially where logs or captured traffic show malformed client-final messages. The failure occurs before credentials are verified and results in loss of all connections pooled by the crashed process.