PgBouncer CVE-2026-19888

Exploitation requires that PgBouncer (through 1.25.2) be configured to use SCRAM authentication (e.g. auth_type=scram-sha-256) so the SCRAM client-final-message parser is reachable, and that the attacker have network access to the PgBouncer listener port. No valid credentials, user interaction, or non-default tuning beyond SCRAM auth are needed - the crash occurs before credential verification. The main limiting factor is that deployments not exposing PgBouncer's port to untrusted networks, or not using the SCRAM handshake path, reduce realistic exposure; impact is availability-only (process crash dropping all pooled connections).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is internally consistent with the description: an unauthenticated remote attacker sends one malformed SCRAM client-final-message over the network to crash the process, with pure availability impact and no confidentiality or integrity loss. The severity is entirely driven by A:H, and it is a genuine availability concern because PgBouncer serves all pooled clients from a single process, so one crafted message drops every database connection behind the pooler - a single-packet, pre-authentication DoS with no valid account, no user interaction, and low complexity. That said, this is a crash/DoS only, not RCE or data exposure, so it is a priority for availability-sensitive deployments rather than a breach risk. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation - meaning: no public exploit identified at time of analysis. The only reference is the vendor changelog, so exploitation status is inferred from CVSS/description rather than confirmed by any exploitation-intelligence source. Bottom line: a credible, easy-to-trigger unauthenticated DoS against a critical infrastructure component, but confined to availability and not currently known to be exploited.

An attacker with network reachability to the PgBouncer listener initiates a SCRAM authentication handshake and sends a client-final-message that omits a mandatory attribute; the parser wrongly reports success, leaves a required value unset, and dereferences it as a NULL pointer, crashing PgBouncer before any credential check. Because all clients share one process, this instantly terminates every pooled connection and denies database access to all downstream applications. No public exploit code was identified at time of analysis, but the trigger is trivial and requires no authentication.