EUVD-2026-28877
GHSA-mhmx-mjv6-w337
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N but AC:H because the attacker must occupy the trusted backend position (compromise or MITM the pooler-to-server link) and win a stack overflow; impact kept high as crash-to-possible-RCE per SSVC total impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
AnalysisAI
Stack-based buffer overflow in PgBouncer before 1.25.2 lets a malicious or impersonated PostgreSQL backend corrupt the pooler's memory during SCRAM authentication. Because the SCRAM code ignores the truncation return value of strlcat() while assembling the client-final-message, a backend that replies with an over-long SCRAM server-final-message nonce overruns a stack buffer, enabling a crash and potentially code execution in the PgBouncer process. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.02%), but SSVC rates the technical impact as total.
Technical ContextAI
PgBouncer is a lightweight connection pooler that sits between database clients and PostgreSQL backends. When PgBouncer authenticates to a backend using SCRAM-SHA-256 (the modern challenge-response mechanism in the PostgreSQL protocol), it must build a client-final-message that concatenates the combined client/server nonce with the client proof. The flaw is CWE-121 (stack-based buffer overflow): the code appends data into a fixed-size stack buffer with strlcat() but does not correctly check strlcat()'s return value, which reports the length that WOULD have been written rather than what fit. When the server-supplied nonce is unusually long, the concatenation logic proceeds as if it succeeded and writes past the end of the stack buffer. The affected component is the SCRAM client implementation inside PgBouncer itself (CPE cpe:2.3:a:n/a:pgbouncer), exercised on the pooler-to-backend authentication path rather than the client-to-pooler path.
RemediationAI
Vendor-released patch: PgBouncer 1.25.2 - upgrade all PgBouncer instances to 1.25.2 or later, per the changelog at https://www.pgbouncer.org/changelog.html#pgbouncer-125x. Until patched, reduce exposure by ensuring PgBouncer only connects to trusted, known-good PostgreSQL backends and by protecting the pooler-to-backend network path so a backend cannot be impersonated: require TLS with verify-full (server certificate verification) on the PgBouncer-to-PostgreSQL connection so a rogue server cannot substitute itself, and segment the database network so only the legitimate backend host can answer on the Postgres port. The trade-off of verify-full is stricter certificate management and possible connection failures if backend certificates are misconfigured; network segmentation offers no protection if the legitimate backend itself is compromised. These are compensating controls only - patching to 1.25.2 remains the sole complete fix.
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by send
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Se
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value,
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to
Remote denial-of-service in PgBouncer versions before 1.25.2 allows unauthenticated attackers to crash the connection po
Denial of service in PgBouncer before 1.25.2 lets a malicious or malfunctioning PostgreSQL backend crash the connection
The add_database function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a d
PgBouncer before version 1.25.2 fails to properly restrict the KILL_CLIENT admin command to authorized users, allowing a
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today