EUVD-2026-28878
GHSA-4463-8rvf-rj9f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:N as it operates over the network, but AC:H because it requires a malicious or malfunctioning backend server to emit a non-standard SQLSTATE-less error; availability-only impact (A:H, C/I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.
AnalysisAI
Denial of service in PgBouncer before 1.25.2 lets a malicious or malfunctioning PostgreSQL backend crash the connection pooler by returning an error response that omits the SQLSTATE field, triggering a null pointer dereference (CWE-476). Because PgBouncer is a shared proxy fronting many client connections, a single crash disrupts all pooled sessions, causing a broad availability outage. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%, 2nd percentile), and SSVC rates exploitation as none - but a vendor patch is available.
Technical ContextAI
PgBouncer is a lightweight connection pooler that sits between application clients and PostgreSQL servers, multiplexing many client connections onto a smaller set of backend server connections. It parses the PostgreSQL wire protocol, including ErrorResponse messages, which normally contain several fields such as severity (S), code/SQLSTATE (C), and message (M). Per CWE-476 (NULL Pointer Dereference), the flaw is that PgBouncer's error-handling path dereferences the SQLSTATE value without verifying the field was present; when a server sends an ErrorResponse lacking the SQLSTATE field, the resulting null dereference crashes the process. The CPE (cpe:2.3:a:n/a:pgbouncer) covers all versions prior to 1.25.2.
RemediationAI
Vendor-released patch: upgrade PgBouncer to 1.25.2 or later, as documented in the vendor changelog (https://www.pgbouncer.org/changelog.html#pgbouncer-125x); this is the primary and recommended fix. If immediate patching is not possible, reduce exposure by ensuring PgBouncer only connects to trusted, controlled PostgreSQL backends - restrict which server hosts PgBouncer is configured to reach and lock down network paths so an untrusted or attacker-controlled server cannot be substituted, since the malformed error response must originate from the backend side. Avoid pointing PgBouncer at third-party or multi-tenant database endpoints you do not control until patched; the trade-off is purely operational scoping and has no functional downside for standard single-owner deployments. Monitor PgBouncer process health and configure automatic restart (e.g., via systemd) so an induced crash self-recovers, accepting that this mitigates impact but does not prevent the dereference.
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by send
Stack-based buffer overflow in PgBouncer before 1.25.2 lets a malicious or impersonated PostgreSQL backend corrupt the p
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Se
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value,
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to
Remote denial-of-service in PgBouncer versions before 1.25.2 allows unauthenticated attackers to crash the connection po
The add_database function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a d
PgBouncer before version 1.25.2 fails to properly restrict the KILL_CLIENT admin command to authorized users, allowing a
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today