PgBouncer SCRAM Vulnerability (CVE-2026-6665) Allows Stack Overflow
A critical vulnerability, CVE-2026-6665, has been identified in PgBouncer versions prior to 1.25.2. According to the National Vulnerability Database, the SCRAM authentication code fails to correctly validate the return value of strlcat() when constructing the client-final-message. This oversight creates a dangerous attack vector.
Attackers can exploit this by crafting a malicious backend that sends a SCRAM server-final-message containing an excessively long nonce. This malformed message triggers a stack overflow within PgBouncer, leading to potential denial-of-service or even remote code execution, depending on memory layout. The National Vulnerability Database assigns this a high-severity CVSS score of 8.1, emphasizing the significant risk.
Defenders running PgBouncer instances must prioritize patching. This isn’t theoretical; it’s a direct code flaw that can be leveraged by a malicious actor with network access to the PgBouncer instance. Update immediately to version 1.25.2 or later to mitigate this critical risk. Ignoring this is inviting a breach.
What This Means For You
- If your organization uses PgBouncer, you need to immediately check your version. Any instance running prior to 1.25.2 is vulnerable to CVE-2026-6665, which can lead to a stack overflow. Prioritize patching to version 1.25.2 or higher to prevent potential denial-of-service or more severe compromise.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-6665 PgBouncer SCRAM Stack Overflow Attempt
title: CVE-2026-6665 PgBouncer SCRAM Stack Overflow Attempt
id: scw-2026-05-09-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-6665 by monitoring PgBouncer processes that receive SCRAM authentication requests and return an HTTP 500 status code, indicative of a potential stack overflow triggered by a crafted server-final-message with a long nonce.
author: SCW Feed Engine (AI-generated)
date: 2026-05-09
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-6665/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: authentication
detection:
selection:
Image|startswith:
- 'pgbouncer.exe'
cs-uri-query|contains:
- 'SCRAM'
sc-status:
- 500
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6665 | Buffer Overflow | PgBouncer versions prior to 1.25.2 |
| CVE-2026-6665 | Buffer Overflow | Vulnerable component: SCRAM code in PgBouncer |
| CVE-2026-6665 | Buffer Overflow | Vulnerable function: strlcat() return value check |
| CVE-2026-6665 | Buffer Overflow | Attack vector: Malicious backend sending long SCRAM server-final-message nonce |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 09, 2026 at 04:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console...
CVE-2026-6666 — A possible null pointer reference in PgBouncer before
CVE-2026-6666 — A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE...
PgBouncer Integer Overflow (CVE-2026-6664) Leads to Remote Crash
CVE-2026-6664 — An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An...