CVE-2026-6664: PgBouncer integer overflow in PgBouncer network packet parsing
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
Other sources
PgBouncer integer overflow in PgBouncer network packet parsing
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6664?
CVE-2026-6664 is considered to have a high severity due to the potential for remote unauthenticated attackers to crash the PgBouncer service.
How do I fix CVE-2026-6664?
To fix CVE-2026-6664, upgrade PgBouncer to version 1.25.2 or later.
What type of attack does CVE-2026-6664 involve?
CVE-2026-6664 involves an integer overflow attack that allows attackers to bypass a boundary check in the network packet parsing code.
Which versions of PgBouncer are affected by CVE-2026-6664?
PgBouncer versions prior to 1.25.2 are affected by CVE-2026-6664.
Can CVE-2026-6664 be exploited without authentication?
Yes, CVE-2026-6664 can be exploited by unauthenticated remote attackers.