CVE 2026 6664

nvd.nist.gov • May 20, 2026

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Integer Overflow Vulnerability in PgBouncer (CVE-2026-6664) A critical integer overflow vulnerability (CVE-2026-6664) has been identified in PgBouncer versions prior to 1.25.2. This flaw allows unauthenticated remote attackers to crash the service by sending a malformed SCRAM authentication packet. The vulnerability bypasses a boundary check in the network packet parsing code, specifically in the `mbuf_get_bytes()` function. A proof-of-concept exploit demonstrating this denial-of-service condition was released on May 13, 2026. Affected versions include all PgBouncer releases up to and including 1.25.1. System administrators are urged to upgrade to version 1.25.2 or later to mitigate this risk. The vulnerability was published on May 9, 2026, and poses a significant threat to systems using PgBouncer for connection pooling. 72

Extracted Entities

CVE 2026 6664

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)