CVE-2026-6665CWE-121
PgBouncer buffer overflow in SCRAM
High · published May 9, 2026
What it is
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
The record
Technical detail
- CVSS v3.1
- 8.1 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00443 · 37.5th percentile
- Weakness
- CWE-121 · Stack-based Buffer Overflow
- Published
- 2026-05-09T00:43Z
EPSS history
Timeline