EUVD-2026-28878
GHSA-4463-8rvf-rj9f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessControl or compromise a backend PostgreSQL server
-
DeliveryServer returns ErrorResponse without SQLSTATE field
-
ExploitNull pointer dereference in PgBouncer error handler
-
ExecutionPgBouncer process crashes
-
ImpactAll pooled client connections dropped (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a PostgreSQL server behind PgBouncer send an ErrorResponse message that omits the SQLSTATE (error code 'C') field - an abnormal, non-standard response most well-behaved PostgreSQL servers never produce. This means the attacker must control or compromise a backend database server, or otherwise induce it to emit a malformed error, rather than exploit from the ordinary client side; a normal, trusted, unmodified PostgreSQL backend does not trigger the bug. Limiting factors: the condition is non-default (standard servers include SQLSTATE), impact is availability-only (crash/DoS, no data compromise), and it affects only PgBouncer versions before 1.25.2. |
| Impact | Signals are consistent and point to a real but low-priority availability bug rather than an urgent threat. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) scores availability-only impact, but its PR:N/AC:L framing understates a key nuance: the malformed message must come from the PostgreSQL *server side*, not an arbitrary network client, so realistic exploitation requires a compromised, malicious, or buggy backend server that PgBouncer trusts and connects to. This is why EPSS is essentially zero (0.01%), the CVE is not on CISA KEV, and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial. There is no confidentiality or integrity impact - only a crash. Net: patch during normal maintenance windows; this is not a drop-everything issue, and the high CVSS is driven almost entirely by the A:H availability score. |
| Exploit ScenarioDerived | A PostgreSQL backend that PgBouncer connects to - whether attacker-controlled, compromised, or simply buggy - returns an ErrorResponse message that omits the SQLSTATE field. PgBouncer dereferences the missing value and crashes, dropping every pooled client connection routed through that instance and causing an application-wide database outage until the process restarts. No public exploit is identified at time of analysis, and triggering it requires influence over the server-side response rather than ordinary client access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 24, 2026
Denial of service in PgBouncer before 1.25.2 lets a malicious or malfunctioning PostgreSQL backend crash the connection pooler by returning an error response that omits the SQLSTATE field, triggering a null pointer dereference (CWE-476). Because PgBouncer is a shared proxy fronting many client connections, a single crash disrupts all pooled sessions, causing a broad availability outage. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%, 2nd percentile), and SSVC rates exploitation as none - but a vendor patch is available.
Earlier versions of this analysis (1)
PgBouncer before version 1.25.2 crashes when a backend PostgreSQL server sends an error response lacking an SQLSTATE field, enabling denial of service against connection pooling infrastructure. The vulnerability requires an attacker to control or compromise a PostgreSQL backend server or intercept server responses on the network, making exploitation conditional on non-default network topology or server compromise. CVSS score of 5.9 reflects high availability impact but limited attack surface due to medium complexity (AC:H).
RemediationAI
Vendor-released patch: upgrade PgBouncer to 1.25.2 or later, as documented in the vendor changelog (https://www.pgbouncer.org/changelog.html#pgbouncer-125x); this is the primary and recommended fix. If immediate patching is not possible, reduce exposure by ensuring PgBouncer only connects to trusted, controlled PostgreSQL backends - restrict which server hosts PgBouncer is configured to reach and lock down network paths so an untrusted or attacker-controlled server cannot be substituted, since the malformed error response must originate from the backend side. Avoid pointing PgBouncer at third-party or multi-tenant database endpoints you do not control until patched; the trade-off is purely operational scoping and has no functional downside for standard single-owner deployments. Monitor PgBouncer process health and configure automatic restart (e.g., via systemd) so an induced crash self-recovers, accepting that this mitigates impact but does not prevent the dereference.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PgBouncer is a lightweight connection pooler that sits between application clients and PostgreSQL servers, multiplexing many client connections onto a smaller set of backend server connections. It parses the PostgreSQL wire protocol, including ErrorResponse messages, which normally contain several fields such as severity (S), code/SQLSTATE (C), and message (M). Per CWE-476 (NULL Pointer Dereference), the flaw is that PgBouncer's error-handling path dereferences the SQLSTATE value without verifying the field was present; when a server sends an ErrorResponse lacking the SQLSTATE field, the resulting null dereference crashes the process. The CPE (cpe:2.3:a:n/a:pgbouncer) covers all versions prior to 1.25.2.
Know when Pgbouncer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:N as it operates over the network, but AC:H because it requires a malicious or malfunctioning backend server to emit a non-standard SQLSTATE-less error; availability-only impact (A:H, C/I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.
Executive ViewAI
PgBouncer versions before 1.25.2 contain a denial-of-service vulnerability that crashes the connection pooler when a PostgreSQL backend returns a malformed error response, immediately severing all pooled client connections and causing database unavailability across all dependent applications. Any organization running PgBouncer in production faces complete loss of database access if a backend is compromised or misconfigured, with no warning or graceful degradation. A patch is available and deployment should be prioritized as high-urgency maintenance.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in PgBouncer Multiple Security Issues
View all 4PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by send
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Se
Authentication bypass in PgBouncer 1.17.0 through 1.26.0 allows an authenticated attacker who knows a valid password for
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value,
Arbitrary SQL execution during authentication affects PgBouncer before 1.25.1 when the non-default auth_query feature is
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries
Unauthenticated remote attackers can render PgBouncer 1.20.0 through 1.26.0 unresponsive by sending a single crafted Sta
A crafted oversized input to the PgBouncer connection pooler (versions through 1.25.2) triggers an integer overflow in p
Unauthenticated remote attackers can crash PgBouncer through 1.25.2 by sending a malformed SCRAM client-final-message th
Exploit-DB