CVE-2026-19888: PgBouncer SCRAM Parser DoS Vulnerability

CVE-2026-19888 Overview

CVE-2026-19888 is a NULL pointer dereference vulnerability [CWE-476] in the Salted Challenge Response Authentication Mechanism (SCRAM) client-final-message parser used by PgBouncer through version 1.25.2. The parser fails to validate a mandatory attribute in the client-final-message, allowing it to report success while leaving a required value unset. That unset value is later dereferenced, crashing the process. An unauthenticated remote attacker can trigger the flaw before any credential verification takes place.

Critical Impact
Because PgBouncer serves all clients from a single process, a single malformed SCRAM message terminates every pooled database connection, producing an availability outage across all downstream PostgreSQL clients.

Affected Products

PgBouncer versions through 1.25.2
Deployments exposing PgBouncer to untrusted networks
Any environment pooling PostgreSQL connections through vulnerable PgBouncer instances

Discovery Timeline

2026-09-23 - CVE-2026-19888 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-19888

Vulnerability Analysis

PgBouncer is a lightweight connection pooler for PostgreSQL. It handles authentication on behalf of pooled clients, including the SCRAM-SHA-256 exchange defined in RFC 5802. During SCRAM, the client transmits a client-final-message containing several mandatory attributes, including the c= channel-binding value and the p= client proof.

The parser in vulnerable PgBouncer builds does not enforce that every mandatory attribute is present before returning success. When a required field is absent, the parser leaves the corresponding internal pointer at its uninitialized or NULL state, then returns as if parsing completed correctly. Downstream authentication code dereferences that pointer, causing an immediate process crash.

Because PgBouncer is single-process, the crash tears down every pooled connection managed by that instance. All clients lose their sessions until the pooler restarts.

Root Cause

The root cause is missing input validation in the SCRAM client-final-message parser. The parser signals success without verifying that all mandatory SCRAM attributes were populated. A subsequent NULL pointer dereference [CWE-476] converts the parsing gap into a process-terminating fault.

Attack Vector

Exploitation requires only network reachability to the PgBouncer listener. The attacker initiates a SCRAM authentication handshake and sends a crafted client-final-message that omits a mandatory attribute. The crash occurs before credentials are verified, so no valid PostgreSQL account, username, or password is required. Repeated exploitation produces a sustained denial-of-service condition against every database consumer routed through the pooler.

No verified public proof-of-concept code is available. Refer to the PgBouncer Changelog for the maintainer's technical description of the fix.

Detection Methods for CVE-2026-19888

Indicators of Compromise

Unexpected PgBouncer process termination or repeated restarts recorded in the service manager (systemd, supervisord, or equivalent).
Abrupt disconnection of all pooled PostgreSQL client sessions at the same timestamp.
Inbound TCP connections to the PgBouncer listener that initiate a SCRAM handshake and immediately close.

Detection Strategies

Alert on PgBouncer process exits with non-zero status codes or signal-terminated events such as SIGSEGV.
Correlate mass disconnection events across pooled clients with a preceding new inbound connection to the pooler port.
Inspect PgBouncer logs for authentication attempts that stop mid-SCRAM without completing the SASLResponse sequence.

Monitoring Recommendations

Track PgBouncer uptime and restart counts as an availability signal in your metrics platform.
Monitor connection counts to the PgBouncer listener from non-application source addresses.
Forward PgBouncer and host process logs to a centralized analytics platform for correlation with network telemetry.

How to Mitigate CVE-2026-19888

Immediate Actions Required

Upgrade PgBouncer to a version released after 1.25.2 that contains the SCRAM parser fix documented in the PgBouncer Changelog.
Restrict network access to the PgBouncer listener to trusted application subnets using host firewalls or security groups.
Enable automatic service restart for PgBouncer so the pooler recovers quickly if a crash occurs.

Patch Information

The PgBouncer maintainers address the missing SCRAM attribute validation in the release following 1.25.2. Consult the PgBouncer Changelog for the exact fixed version and upgrade notes before deploying.

Workarounds

Place PgBouncer behind a network access control list that permits only known application clients until patching completes.
Terminate SCRAM authentication at a hardened proxy or PostgreSQL directly for exposed deployments where upgrade is delayed.
Configure the service supervisor to restart PgBouncer on failure to reduce the window of unavailability after a crash.

bash

# Example systemd override to auto-restart PgBouncer on crash
# /etc/systemd/system/pgbouncer.service.d/override.conf
[Service]
Restart=always
RestartSec=2s
StartLimitBurst=0