PgBouncer CVE-2026-6665

Requires the attacker to act as the PostgreSQL backend that PgBouncer authenticates to: either a compromised/rogue backend server or an active man-in-the-middle on the PgBouncer-to-PostgreSQL connection. PgBouncer must be using SCRAM-SHA-256 authentication toward that backend and must be running a version before 1.25.2. The concrete trigger is a SCRAM server-final-message carrying an over-long nonce. Limiting factors that reduce real-world risk: the malicious input originates from the backend (normally a trusted component), so this is not exploitable by ordinary database clients connecting through the pooler; exploitation is blocked if the pooler-to-backend link uses TLS with certificate verification and the backend host is trusted and uncompromised; SSVC marks exploitation as none and not automatable.

The signals conflict sharply and should temper the headline CVSS of 9.8. The published vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H implies trivial unauthenticated remote exploitation, but the description makes clear the trigger comes from a MALICIOUS BACKEND sending a crafted server-final-message - i.e. the attacker must control, compromise, or man-in-the-middle the PostgreSQL server that PgBouncer connects to, which is normally a trusted component. That precondition is not captured by the base score and should be verified against the vendor changelog. Corroborating lower real-world urgency: EPSS is 0.02% (4th percentile), and CISA's SSVC framework marks Exploitation as none and Automatable as no, while agreeing Technical Impact is total. There is no KEV listing and no public exploit identified at time of analysis. Net assessment: a genuine memory-safety defect with high theoretical impact (crash, possible RCE in the pooler) but a constrained, non-default threat model - realistic priority is moderate, dominated by scenarios where the backend or the pooler-to-backend link is untrusted, not by opportunistic internet-wide attack.

An attacker who controls a PostgreSQL backend - a compromised database host, a rogue server inserted via DNS/ARP spoofing, or a man-in-the-middle on an unencrypted pooler-to-backend link - waits for PgBouncer to open a pooled connection and begin SCRAM authentication. During the handshake the malicious backend returns a server-final-message containing an abnormally long nonce, overflowing PgBouncer's stack buffer to crash the pooler (denial of service) or potentially execute code in its process. No public proof-of-concept exists at time of analysis, and the need to occupy the backend position plus stack-overflow reliability make code execution non-trivial.