Skip to content
fr Sign in
5.9 Medium

CVE-2026-6669 Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in…

Description

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.

Affected products and versions

Product Affected versions Fixed in
pgbouncer 1.25 earliest → 1.25.2 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of pgbouncer

The 13 CVEs of pgbouncer →
CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user… 8.8 High CVE-2026-107349 An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of… 7.5 High CVE-2026-107348 Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a… 5.9 Medium CVE-2026-19888 Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2… 7.5 High
Track this CVE