What is the CVSS score of EUVD-2026-28877?

EUVD-2026-28877 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PgBouncer are affected by EUVD-2026-28877?

CVE-2026-6665 is a stack overflow vulnerability in PgBouncer connection pooling software that allows attackers controlling a backend PostgreSQL server to achieve remote code execution through SCRAM…. A patch is available.

How to fix or mitigate EUVD-2026-28877?

Within 24 hours: Inventory all PgBouncer deployments and confirm current versions; assess whether backend PostgreSQL servers are exposed to untrusted networks or compromise risk. Within 7 days: Implement network segmentation to restrict backend PostgreSQL server access to trusted PgBouncer instances only; monitor for suspicious SCRAM authentication attempts. Within 30 days: Upgrade PgBouncer to version 1.25.2 or later when vendor releases the patch; apply across all production and non-production instances.

PgBouncer EUVD-2026-28877

| CVE-2026-6665 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-09 PostgreSQL

GHSA-mhmx-mjv6-w337

Stack Overflow Buffer Overflow Pgbouncer

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 09, 2026 - 02:16 EUVD

Analysis Generated

May 09, 2026 - 01:31 vuln.today

CVE Published

May 09, 2026 - 00:43 nvd

HIGH 8.1

DescriptionCVE.org

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.

AnalysisAI

Stack overflow in PgBouncer before 1.25.2 enables malicious PostgreSQL backend servers to trigger remote code execution via SCRAM authentication nonce manipulation. The flaw stems from incorrect strlcat() return value checking during SCRAM client-final-message construction. Remote unauthenticated exploitation is possible (CVSS 8.1, AV:N/PR:N) but requires high attack complexity - specifically, the attacker must control or compromise the backend PostgreSQL server PgBouncer connects to. No public exploit identified at time of analysis; EPSS and KEV data not available in this assessment.

Technical ContextAI

PgBouncer is a lightweight PostgreSQL connection pooler. The vulnerability affects the SCRAM (Salted Challenge Response Authentication Mechanism) implementation, which PgBouncer uses for secure authentication with PostgreSQL backends. CWE-121 indicates a stack-based buffer overflow. The strlcat() function returns the total length of the string it tried to create, not just the number of characters appended. The SCRAM code failed to validate this return value correctly when concatenating components of the client-final-message. When a malicious backend sends a server-final-message containing an abnormally long nonce value, the unchecked strlcat() can overflow the stack buffer allocated for message construction. CPE string (cpe:2.3:a:n/a:pgbouncer:*:*:*:*:*:*:*:*) indicates all PgBouncer versions before 1.25.2 are affected. This is a server-side vulnerability in the connection pooler's authentication handshake logic, not in PostgreSQL itself.

RemediationAI

Upgrade PgBouncer to version 1.25.2 or later, which correctly validates strlcat() return values in SCRAM authentication code. Download from official PgBouncer releases and review the changelog at https://www.pgbouncer.org/changelog.html#pgbouncer-125x for upgrade procedures. If immediate patching is not feasible, implement network segmentation to ensure PgBouncer only connects to trusted, hardened PostgreSQL backend servers - specifically, place backends in isolated VLANs with strict ingress controls to prevent compromise. Disable SCRAM authentication and use legacy md5 or trust methods ONLY if backend servers are in a fully trusted security zone (this degrades authentication security and should be temporary). Monitor PgBouncer logs for authentication anomalies or unexpected server-final-message patterns during SCRAM handshakes. Note that authentication downgrade introduces password transmission risks and should only be used with encrypted connections (TLS) to backends.