EUVD-2026-85363
GHSA-r96c-7w9v-wrc8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PgBouncer listening port
-
DeliverySend oversized packet input
-
ExploitOverflow buffer size computation
-
ExecutionGrowth loop fails to terminate
-
PersistSingle process saturates CPU core
-
ImpactAll pooled connections stall (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of PgBouncer (through 1.25.2): the description explicitly states both unauthenticated and authenticated code paths can reach the overflow, so an attacker only needs network reachability to the pooler's listening port and the ability to send a sufficiently large input. The primary LIMITING factor is impact scope, not access: the flaw yields only denial of service (CPU saturation and stalled connections), with no confidentiality or integrity effect, and recovery requires killing/restarting the process. Realistic exposure depends on whether the PgBouncer port is reachable by untrusted networks versus firewalled to trusted application hosts. |
| Impact | All CVSS signals point to a genuine but availability-only concern: AV:N/AC:L/PR:N/UI:N make this trivially reachable by an unauthenticated remote attacker over the network, and A:H reflects that a single crafted large input can wedge PgBouncer's single-process event loop, saturating a CPU core and stalling every pooled connection until the process is manually killed. However, C:N/I:N confirm there is no data disclosure, tampering, or code execution - this is a pure DoS. No EPSS score, KEV listing, or POC availability was provided in the input, so exploitation probability and real-world weaponization cannot be quantified from the data at hand. The severity is legitimately elevated because PgBouncer is a chokepoint in front of the database (one crash takes down all pooled clients), but this is a service-availability issue rather than a confidentiality/integrity breach; prioritize patching for internet-exposed or shared-tenant poolers, but it is not a high-CVSS-but-fake-risk case nor a confirmed-exploited emergency. Key missing data: no EPSS/KEV/POC signals and only a changelog reference (no dedicated advisory), so exploitation likelihood is inferred, not confirmed. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the PgBouncer listening port sends a sufficiently large packet that triggers the integer overflow in the buffer-growth computation, sending the growth loop into a non-terminating state. This pins a CPU core and freezes the single shared process, stalling every pooled database connection until an operator kills PgBouncer. No POC was identified in the provided data; the unauthenticated code path makes the attack low-complexity per the CVSS AC:L rating. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
A crafted oversized input to the PgBouncer connection pooler (versions through 1.25.2) triggers an integer overflow in packet buffer growth logic, leaving the growth loop unable to terminate and pinning a CPU core permanently because all clients are served from a single process. Per the assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) this is reachable by an unauthenticated remote attacker with only network access to the pooler's listening port, and both unauthenticated and authenticated code paths can reach the flawed computation; there is no confidentiality or integrity impact, but the pooler stalls every pooled connection until the process is killed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore availability-only and depends on whether the PgBouncer port is exposed to untrusted networks rather than firewalled to trusted application hosts.
RemediationAI
The primary fix is to upgrade PgBouncer off the affected range - anything at or below 1.25.2 - to a release that contains the corrected buffer growth logic; because an exact patched version was not independently confirmed in the supplied data, verify the specific fixed release against the vendor changelog at https://www.pgbouncer.org/changelog.html before rolling out, so the remediation corresponds to a version that actually addresses the overflow. Where immediate upgrade is not possible, the most effective compensating control is network scoping rather than authentication: bind PgBouncer's listen address to internal interfaces and use firewall rules or security groups to permit the pooler port only from trusted application hosts, accepting that this does not help deployments where clients are inherently untrusted. Pair that with process supervision that restarts the pooler on failure (for example systemd Restart=always with a short interval) plus CPU-saturation alerting, understanding the trade-off that a restart forcibly drops every pooled connection and will surface as connection errors to applications. A TCP-level front end or proxy that caps per-connection input size and enforces rate limits can blunt the attack, but with the caveat that a single oversized packet - not a flood - is sufficient to trigger the overflow, so size and rate limits must be strict enough to reject large inputs before they reach the pooler. Disabling or removing the affected unauthenticated code path is not possible through configuration alone, and TLS client-certificate enforcement does not mitigate the issue because the overflow is reachable on unauthenticated paths; therefore patching remains the only complete fix and the workarounds above should be treated as temporary risk reduction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PgBouncer is a lightweight connection pooler that multiplexes many client connections onto a small number of PostgreSQL server connections, and it runs as a single process with an event loop rather than forking a worker per client - which is precisely why one wedged loop degrades all tenants. The root cause is CWE-190 (Integer Overflow or Wraparound) in the packet buffer growth logic: when a sufficiently large input forces the buffer, the size computation used to grow that buffer wraps around, so the condition that should terminate the growth loop is never satisfied and the process spins indefinitely instead of rejecting or truncating the oversized packet. The CPE string cpe:2.3:a:n/a:pgbouncer:*:*:*:*:*:*:*:* carries an unresolved vendor field and a wildcard version, so it confirms PgBouncer as the affected product across all versions but does not scope a specific release range beyond the description's statement of "through 1.25.2". Because the defect sits in buffer sizing rather than in authentication or SQL parsing, it is reachable before or independent of successful authentication, matching the PR:N vector.
Know when Pgbouncer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable input (AV:N/AC:L/PR:N/UI:N) triggers a non-terminating loop that stalls the single shared process, so A:H with no confidentiality or integrity impact.
Primary rating from Vendor (PostgreSQL).
CVSS VectorVendor: PostgreSQL
DescriptionCVE.org
Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is killed. Both unauthenticated and authenticated code paths can reach the overflow.
Executive ViewAI
PgBouncer versions through 1.25.2 are vulnerable to an unauthenticated remote denial-of-service attack that can permanently pin a CPU core and stall all pooled database connections, disrupting any application relying on PostgreSQL through this pooler. While no data breach occurs, the availability impact means business-critical services may become unresponsive until the PgBouncer process is manually restarted. Leadership should prioritize this if the PgBouncer port is exposed beyond trusted application hosts, as a single malicious packet can halt database access for all dependent systems.
No vendor patch available. Interim mitigations: restrict network access to trusted hosts (firewall rules), monitor CPU usage for anomalies, implement auto-restart for the PgBouncer process, enforce connection limits, and consider deploying redundant PgBouncer instances behind a load balancer to limit single-point failure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by send
Stack-based buffer overflow in PgBouncer before 1.25.2 lets a malicious or impersonated PostgreSQL backend corrupt the p
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Se
Authentication bypass in PgBouncer 1.17.0 through 1.26.0 allows an authenticated attacker who knows a valid password for
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value,
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries
Unauthenticated remote attackers can render PgBouncer 1.20.0 through 1.26.0 unresponsive by sending a single crafted Sta
Unauthenticated remote attackers can crash PgBouncer through 1.25.2 by sending a malformed SCRAM client-final-message th
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to
Remote denial-of-service in PgBouncer versions before 1.25.2 allows unauthenticated attackers to crash the connection po
Denial of service in PgBouncer before 1.25.2 lets a malicious or malfunctioning PostgreSQL backend crash the connection
Exploit-DB