Back exploit-intel.com

CVE 2026 6664

exploit-intel.com • May 20, 2026

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.

This repository contains a functional proof-of-concept exploit for CVE-2026-6664, demonstrating a PgBouncer crash via an integer overflow in the `mbuf_get_bytes()` function. The exploit leverages a malformed SASL initial response to trigger a denial-of-service condition in PgBouncer versions <= 1.25.1.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Integer Overflow Vulnerability in PgBouncer (CVE-2026-6664) A critical integer overflow vulnerability (CVE-2026-6664) has been identified in PgBouncer versions prior to 1.25.2. This flaw allows unauthenticated remote attackers to crash the service by sending a malformed SCRAM authentication packet. The vulnerability bypasses a boundary check in the network packet parsing code, specifically in the `mbuf_get_bytes()` function. A proof-of-concept exploit demonstrating this denial-of-service condition was released on May 13, 2026. Affected versions include all PgBouncer releases up to and including 1.25.1. System administrators are urged to upgrade to version 1.25.2 or later to mitigate this risk. The vulnerability was published on May 9, 2026, and poses a significant threat to systems using PgBouncer for connection pooling. 72

Extracted Entities

CVE 2026 6664

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)