CVE-2026-6666: Pgbouncer DOS Vulnerability

CVE-2026-6666 Overview

CVE-2026-6666 is a null pointer dereference vulnerability in PgBouncer, the lightweight connection pooler for PostgreSQL. The flaw affects PgBouncer versions prior to 1.25.2 and triggers when a backend PostgreSQL server returns an error response missing the SQLSTATE field. PgBouncer fails to validate the presence of this field before dereferencing it, causing the process to crash. The result is a denial-of-service condition that disrupts all client connections routed through the affected pooler instance. The vulnerability is tracked under CWE-476 (NULL Pointer Dereference).

Critical Impact

A malformed error response from a backend server can crash PgBouncer, terminating all pooled database connections and disrupting application availability.

Affected Products

• PgBouncer versions prior to 1.25.2
• Deployments where PgBouncer brokers connections to untrusted or compromised PostgreSQL backends
• Multi-tenant environments using shared PgBouncer instances

Discovery Timeline

• 2026-05-09 - CVE-2026-6666 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-6666

Vulnerability Analysis

The vulnerability resides in PgBouncer's handling of PostgreSQL backend error messages. The PostgreSQL wire protocol defines error responses as a sequence of typed fields, where field C carries the SQLSTATE code. PgBouncer parses these fields and references the SQLSTATE value during error processing and logging.

When a backend server transmits an error response that omits the SQLSTATE field entirely, PgBouncer does not check whether its internal pointer to that field is NULL before dereferencing it. The resulting segmentation fault terminates the PgBouncer process. Because PgBouncer typically runs as a single multiplexing process, the crash severs every active client and server connection it manages.

This is a pre-authentication-adjacent issue from the network attacker's perspective only if the attacker controls a backend PostgreSQL server. In practice, exploitation requires the ability to position a malicious or compromised PostgreSQL instance behind PgBouncer.

Root Cause

The root cause is missing input validation on data received from a PostgreSQL backend. PgBouncer assumes that well-formed error responses always contain a SQLSTATE field, which is required by the PostgreSQL protocol specification. Non-compliant or maliciously crafted backends can omit this field, leading to a null pointer dereference [CWE-476] when PgBouncer accesses the absent field.

Attack Vector

An attacker who controls or compromises a PostgreSQL server reachable by PgBouncer can craft an error response without a SQLSTATE field. When PgBouncer receives this response during normal query processing or connection setup, the process crashes. This terminates pooled sessions and forces application reconnects until PgBouncer is restarted. Repeated triggering produces a persistent denial-of-service condition. See the PgBouncer Changelog - Version 1.25.x for the upstream description of the fix.

Detection Methods for CVE-2026-6666

Indicators of Compromise

• Unexpected PgBouncer process termination accompanied by SIGSEGV entries in system logs or core dumps
• Sudden mass disconnection events across applications that share a PgBouncer instance
• PostgreSQL backend connections originating from unexpected hosts or sending malformed protocol messages

Detection Strategies

• Monitor PgBouncer process uptime and restart frequency; repeated short-lived processes suggest crash-loop behavior
• Inspect PostgreSQL wire protocol traffic for ErrorResponse messages lacking a C (SQLSTATE) field
• Correlate application connection failures with PgBouncer service restarts in centralized logging

Monitoring Recommendations

• Enable core dump collection for the PgBouncer process to capture crash forensics
• Alert on PgBouncer service restarts via systemd, supervisord, or container orchestration health checks
• Log all backend PostgreSQL endpoints that PgBouncer connects to and review for unauthorized changes

How to Mitigate CVE-2026-6666

Immediate Actions Required

• Upgrade PgBouncer to version 1.25.2 or later on all affected hosts
• Restrict PgBouncer's [databases] configuration so it only connects to trusted PostgreSQL backends
• Place PgBouncer and its backends on isolated network segments to prevent attacker-controlled servers from being introduced
• Configure process supervisors to auto-restart PgBouncer to limit downtime if a crash occurs

Patch Information

The PgBouncer maintainers fixed this issue in version 1.25.2. Refer to the PgBouncer Changelog - Version 1.25.x for release details. Operators should rebuild from the official source or install updated distribution packages once available.

Workarounds

• Ensure all PostgreSQL backends are running official, unmodified PostgreSQL builds that always emit SQLSTATE in error responses
• Enforce network access controls so only authorized PostgreSQL servers can communicate with PgBouncer
• Deploy redundant PgBouncer instances behind a load balancer to maintain availability if a single instance crashes

# Verify the running PgBouncer version and upgrade on Debian/Ubuntu
pgbouncer --version
sudo apt-get update && sudo apt-get install --only-upgrade pgbouncer
sudo systemctl restart pgbouncer
sudo systemctl status pgbouncer