CVE-2026-6669: Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The attacker must control or compromise a PostgreSQL backend that PgBouncer authenticates to using SCRAM. That backend can supply an excessively large key-derivation iteration count during authentication, causing PgBouncer to consume CPU.
What is the operational impact on a shared PgBouncer instance?
A single affected backend can prevent the PgBouncer process from serving traffic for every database and client it pools. The issue is not contained to connections for the malicious or compromised backend.
Can the CPU-intensive operation be interrupted once it starts?
No. In frontend builds such as PgBouncer, the resulting key derivation cannot be interrupted.
Which versions are affected?
PgBouncer through version 1.25.2 is affected.