CVE-2026-6668: PgBouncer Integer Overflow DoS Vulnerability

CVE-2026-6668 Overview

CVE-2026-6668 is an integer overflow vulnerability [CWE-190] in the packet buffer growth logic of PgBouncer through version 1.25.2. An unauthenticated remote attacker can send sufficiently large input to overflow the buffer size computation. The resulting condition prevents the growth loop from terminating, saturating a CPU core.

PgBouncer serves all pooled clients from a single process. When the overflow triggers, every pooled connection stalls until an operator terminates the process. Both unauthenticated and authenticated code paths reach the vulnerable computation, which broadens the exposure to any network-reachable PgBouncer instance.

Critical Impact
A single crafted request can stall all database traffic behind a PgBouncer pooler, disrupting every application that depends on the connection pool.

Affected Products

PgBouncer versions through 1.25.2
Deployments exposing PgBouncer to untrusted networks
Any pooled PostgreSQL environment fronted by an affected PgBouncer instance

Discovery Timeline

2026-09-23 - CVE-2026-6668 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-6668

Vulnerability Analysis

PgBouncer maintains per-connection packet buffers that grow as inbound data arrives. The growth routine calculates a new buffer size based on the requested capacity. When the requested value approaches the maximum representable integer, the arithmetic used to compute the next buffer size wraps around.

The resulting size compares as smaller than what was requested. The growth loop then repeats the calculation without ever satisfying the size condition. Because PgBouncer runs as a single-threaded event-driven process, the looping code path pins one CPU core at 100 percent and blocks the event loop that services every pooled client.

The overflow is reachable before authentication completes. An attacker only needs the ability to open a TCP connection to the pooler port.

Root Cause

The root cause is unchecked integer arithmetic in the buffer growth calculation [CWE-190]. The code assumes the computed capacity always exceeds the requested capacity, which fails once the value wraps past the integer maximum. No bounds check rejects oversized allocation requests before the arithmetic executes.

Attack Vector

Exploitation requires no credentials and no user interaction. An attacker sends a crafted protocol message with a length field or payload large enough to force the buffer growth code into the overflow condition. Refer to the PgBouncer Change Log for the fixed release notes and upstream fix references. No public proof-of-concept code is referenced in the advisory.

Detection Methods for CVE-2026-6668

Indicators of Compromise

A PgBouncer process consuming 100 percent of a CPU core with no corresponding increase in query throughput.
Client applications reporting connection stalls, timeouts, or hung queries against pooled databases.
Unusually large protocol length fields observed in packet captures targeting the PgBouncer listener port.

Detection Strategies

Monitor PgBouncer process CPU utilization and alert when a single worker sustains near-100 percent usage for more than 60 seconds.
Track the SHOW STATS and SHOW POOLS administrative commands for stalled cl_waiting counters that grow without matching sv_active activity.
Inspect network telemetry for oversized PostgreSQL protocol messages sent to PgBouncer listener ports.

Monitoring Recommendations

Forward PgBouncer logs and host process metrics into a centralized analytics platform for correlation with client-side timeouts.
Alert on repeated abrupt PgBouncer restarts, which may indicate operators killing hung processes.
Baseline normal packet sizes to the pooler port so anomalous inbound traffic surfaces quickly.

How to Mitigate CVE-2026-6668

Immediate Actions Required

Upgrade PgBouncer to a release later than 1.25.2 that contains the fix documented in the vendor change log.
Restrict network access to PgBouncer listener ports so only trusted application hosts can connect.
Add process supervision to automatically restart PgBouncer if CPU saturation is detected.

Patch Information

The PgBouncer maintainers addressed the overflow in a release following 1.25.2. Consult the PgBouncer Change Log to identify the fixed version and apply it across all deployments. Rebuild any container images or configuration management artifacts that pin an affected version.

Workarounds

Place PgBouncer behind a firewall or private network segment that blocks connections from untrusted sources until patching completes.
Enforce TLS client certificate authentication at a proxy layer to limit which peers can reach the pooler.
Deploy multiple PgBouncer processes behind a load balancer so a single stalled process does not exhaust all pooled capacity.

bash

# Example: restrict PgBouncer to trusted subnets via host firewall
iptables -A INPUT -p tcp --dport 6432 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6432 -j DROP