CVE-2026-6665

9.8 criticalEPSS 0.4%

Critical (9.8) in pgbouncer pgbouncer. EPSS 0.4% chance of exploitation in the next 30 days.

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-121
Published: 2026-05-09
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

Affected

pgbouncer:pgbouncer

References

https://www.pgbouncer.org/changelog.html#pgbouncer-125x

Check your stack JSON