CVE-2026-6669 Overview
CVE-2026-6669 is a denial-of-service vulnerability in PgBouncer through version 1.25.2. PgBouncer fails to enforce an upper bound on the key derivation iteration count accepted during Salted Challenge Response Authentication Mechanism (SCRAM) authentication to a backend PostgreSQL server. A malicious or compromised backend can advertise an arbitrarily large iteration count, forcing PgBouncer into uncontrolled CPU consumption. Because PgBouncer serves all clients from a single process, one hostile backend halts traffic for every database and client the pooler serves. The weakness is classified as uncontrolled resource consumption [CWE-400].
Critical Impact
A single malicious PostgreSQL backend can freeze the entire PgBouncer process, breaking connection pooling for every unrelated database and client sharing the pooler.
Affected Products
- PgBouncer versions through 1.25.2
- Deployments using SCRAM authentication to backend PostgreSQL servers
- Multi-tenant environments pooling connections to multiple PostgreSQL backends
Discovery Timeline
- 2026-09-23 - CVE-2026-6669 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-6669
Vulnerability Analysis
PgBouncer implements SCRAM as a client during backend authentication. SCRAM uses PBKDF2 to derive keys, and the iteration count is supplied by the server. PgBouncer accepts this value without validating an upper bound. When a backend returns an inflated iteration count, PgBouncer performs the corresponding PBKDF2 computation synchronously on its single event-loop process.
The key derivation call cannot be interrupted in frontend builds such as PgBouncer. The single-process architecture that gives PgBouncer its efficiency becomes the failure amplifier here. While the process is burning CPU on one backend's PBKDF2 loop, every other pooled client waits. The blast radius is the entire pooler, not the misbehaving backend.
Root Cause
The root cause is missing input validation on a protocol-supplied numeric parameter. PgBouncer trusts the backend-provided SCRAM iteration count and passes it directly to the key derivation routine. No sanity ceiling exists, and no cooperative yielding is performed inside the derivation loop.
Attack Vector
The attacker must control or compromise a PostgreSQL backend that PgBouncer authenticates against. During the SCRAM exchange, the malicious backend responds with an iteration count large enough to consume seconds or minutes of CPU per authentication attempt. Repeated triggering keeps the PgBouncer process pinned, denying service to unrelated tenants. Refer to the PgBouncer Changelog for release notes and fix details.
Detection Methods for CVE-2026-6669
Indicators of Compromise
- Sustained 100% CPU utilization by the PgBouncer process without a corresponding rise in client query volume.
- Backend authentication attempts followed by long stalls in client-facing query latency across multiple pooled databases.
- PgBouncer logs showing prolonged time spent in SCRAM authentication with a single backend.
Detection Strategies
- Instrument PgBouncer host metrics to alert on CPU saturation combined with a drop in SHOW STATS transaction throughput.
- Parse PgBouncer logs for SCRAM authentication events and measure elapsed time between SASLInitialResponse and successful AuthenticationOk messages.
- Correlate anomalous authentication latency with the specific backend server address recorded in the connection log.
Monitoring Recommendations
- Track process-level CPU time for PgBouncer and page on values exceeding baseline for more than 30 seconds.
- Monitor client connection wait times using SHOW POOLS output and alert when cl_waiting grows while sv_active remains low.
- Capture PostgreSQL backend configuration changes, especially any modification to SCRAM iteration parameters on servers the pooler connects to.
How to Mitigate CVE-2026-6669
Immediate Actions Required
- Upgrade PgBouncer to a release later than 1.25.2 that enforces an upper bound on the SCRAM iteration count.
- Audit all PostgreSQL backends the pooler connects to and confirm none have been reconfigured to advertise abnormal iteration counts.
- Restrict network paths so PgBouncer only reaches trusted PostgreSQL backends.
Patch Information
The fix is tracked in the PgBouncer Changelog. Apply the vendor-supplied update that introduces a maximum accepted iteration count during backend SCRAM authentication. No configuration-only remediation is documented.
Workarounds
- Isolate PgBouncer instances per trust boundary so a compromised backend cannot impact unrelated tenants sharing the same pooler.
- Use network segmentation and firewall rules to prevent untrusted PostgreSQL servers from participating in the SCRAM exchange with PgBouncer.
- Monitor backend PostgreSQL configuration for unexpected changes to password encryption iteration settings and roll back deviations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
