CVE-2026-6664: PgBouncer DOS Vulnerability

CVE-2026-6664 Overview

CVE-2026-6664 is an integer overflow vulnerability in the network packet parsing code of PgBouncer, a lightweight connection pooler for PostgreSQL. The flaw exists in versions prior to 1.25.2 and stems from a bypassed boundary check during processing of Salted Challenge Response Authentication Mechanism (SCRAM) authentication packets. An unauthenticated remote attacker can send a malformed SCRAM packet to crash the PgBouncer process, producing a denial-of-service condition against database connection pooling infrastructure. The vulnerability is tracked under [CWE-190] Integer Overflow or Wraparound.

Critical Impact

Unauthenticated remote attackers can crash PgBouncer with a single malformed SCRAM authentication packet, disrupting all PostgreSQL connections routed through the pooler.

Affected Products

• PgBouncer versions prior to 1.25.2
• Deployments exposing PgBouncer listeners to untrusted networks
• PostgreSQL environments relying on PgBouncer for connection pooling

Discovery Timeline

• 2026-05-09 - CVE-2026-6664 published to the National Vulnerability Database (NVD)
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-6664

Vulnerability Analysis

The vulnerability resides in PgBouncer's network packet parsing routine that handles SCRAM authentication messages. SCRAM is the default authentication mechanism for modern PostgreSQL deployments, and PgBouncer parses these packets before forwarding or terminating the authentication exchange. A length field within the malformed packet triggers an arithmetic operation that wraps around the bounds of an integer type. The wrapped value then defeats a subsequent boundary check that would normally reject oversized or malformed input.

Because the boundary check is bypassed, the parser proceeds with invalid offsets or sizes, leading to a process crash. The crash terminates the PgBouncer daemon and severs all pooled client sessions. Applications dependent on the pooler lose database connectivity until the service is restarted.

Root Cause

The root cause is an integer overflow [CWE-190] in arithmetic performed on attacker-controlled length values inside the SCRAM packet parser. The code computes a size or offset that overflows the underlying integer type, producing a small or negative value that satisfies a length comparison intended to enforce safe bounds. Subsequent memory access or parsing logic operates on the corrupted value and crashes the process.

Attack Vector

Exploitation requires only network reachability to the PgBouncer listener. No authentication or user interaction is needed because the parser processes the SCRAM packet during the pre-authentication phase. An attacker sends a crafted SCRAM client message with a manipulated length field that triggers the overflow. The PgBouncer process crashes, denying database access to all clients of that pooler instance. Repeated transmission against a restarted service produces sustained denial of service.

No public proof-of-concept or in-the-wild exploitation has been reported. Refer to the PgBouncer Change Log for the maintainer's description of the fix.

Detection Methods for CVE-2026-6664

Indicators of Compromise

• Unexpected PgBouncer process termination or repeated restarts logged by the service manager
• Connection failures from application tiers immediately following inbound traffic on the PgBouncer port
• SCRAM authentication packets with malformed or implausible length fields captured by network monitoring
• Source IP addresses generating short-lived TCP sessions to the PgBouncer listener followed by service crashes

Detection Strategies

• Monitor PgBouncer process uptime and alert on abnormal exits or core dumps in systemd, supervisord, or container orchestrator logs
• Inspect PgBouncer logs for truncated authentication exchanges and SCRAM parsing errors preceding termination
• Deploy network intrusion detection signatures that flag PostgreSQL wire-protocol messages with inconsistent length headers during the SASL/SCRAM handshake
• Correlate database client connection failures with PgBouncer process restarts across the fleet

Monitoring Recommendations

• Track the running version of PgBouncer across all hosts and alert when versions earlier than 1.25.2 are detected
• Forward PgBouncer syslog output and orchestrator events to a centralized logging platform for correlation
• Baseline normal authentication packet rates per source and alert on anomalous SCRAM traffic patterns

How to Mitigate CVE-2026-6664

Immediate Actions Required

• Upgrade PgBouncer to version 1.25.2 or later on every host running the pooler
• Restrict network access to PgBouncer listeners using firewall rules so only trusted application subnets can reach the service
• Place PgBouncer behind a private network segment or VPN rather than exposing it to the public internet
• Enable automatic process supervision so PgBouncer restarts quickly after a crash while patches are deployed

Patch Information

The maintainers fixed the integer overflow in PgBouncer 1.25.2. Details are documented in the PgBouncer Change Log. Operators should pull the updated package from their distribution repository or build from the upstream release tag.

Workarounds

• Block inbound traffic to the PgBouncer port from untrusted networks at the host or perimeter firewall
• Require TLS client certificates at a reverse proxy in front of PgBouncer to reject unauthenticated packets before they reach the parser
• Use process supervision with rate-limited restarts to reduce service downtime if a crash occurs prior to patching

# Example: restrict PgBouncer listener to trusted application subnet using iptables
iptables -A INPUT -p tcp --dport 6432 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6432 -j DROP

# Verify installed PgBouncer version
pgbouncer --version