Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-19888 Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2…

Description

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.

Produits et versions touchés

Produit Versions touchées Corrigé en
pgbouncer 1.25 premières → 1.25.2 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de pgbouncer

Les 13 CVE de pgbouncer →
CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user… 8.8 Élevée CVE-2026-107349 An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of… 7.5 Élevée CVE-2026-107348 Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a… 5.9 Moyenne CVE-2026-6669 Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in… 5.9 Moyenne
Suivre cette CVE