Aller au contenu
en Se connecter
5.9 Moyenne

CVE-2026-6669 Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in…

Description

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.

Produits et versions touchés

Produit Versions touchées Corrigé en
pgbouncer 1.25 premières → 1.25.2 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de pgbouncer

Les 13 CVE de pgbouncer →
CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user… 8.8 Élevée CVE-2026-107349 An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of… 7.5 Élevée CVE-2026-107348 Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a… 5.9 Moyenne CVE-2026-19888 Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2… 7.5 Élevée
Suivre cette CVE