p PatchFirst

CVE-2026-6664

CVE-2026-6664 · PgBouncer integer overflow in PgBouncer network packet parsing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.

CVSS 7.5 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • pgbouncer

    Versions
    • ≥ 0, < 1.25.2: Affected (semver)

    Update to 1.25.2

  • pgbouncer Debian:12

    Versions
    • 1.18.0-1
    • 1.18.0-1+deb12u1
    • 1.19.0-1
    • 1.19.1-1
    • 1.20.0-1
    • 1.20.1-1
    • 1.21.0-1
    • 1.22.0-1
    • 1.22.1-1
    • 1.23.0-1
    • 1.23.1-1
    • 1.24.0-2
    • 1.24.0-3
    • 1.24.1-1
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.1-1
    • 1.25.2-1
    • 1.26.0-1
    • 1.26.0-2
    • 1.26.0-3
    • 1.26.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Debian:13

    Versions
    • 1.24.1-1
    • 1.24.1-1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 1.24.1-1+deb13u2

    Update to 1.24.1-1+deb13u2

  • pgbouncer Debian:14

    Versions
    • 1.24.1-1
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.1-1
    Affected ranges
    • ECOSYSTEM: < 1.25.2-1

    Update to 1.25.2-1

  • pgbouncer Ubuntu:16.04:LTS

    Versions
    • 1.5.5-1
    • 1.6.1-1
    • 1.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:18.04:LTS

    Versions
    • 1.7.2-3build1
    • 1.7.2-65-g2b8e6cf-1
    • 1.8.1-1
    • 1.8.1-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:20.04:LTS

    Versions
    • 1.10.0-1
    • 1.10.0-1build1
    • 1.11.0-1
    • 1.12.0-2
    • 1.12.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:22.04:LTS

    Versions
    • 1.15.0-1
    • 1.16.1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:24.04:LTS

    Versions
    • 1.20.0-1
    • 1.21.0-1
    • 1.22.0-1
    • 1.22.0-1build1
    • 1.22.0-1build3
    • 1.22.0-1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:25.10

    Versions
    • 1.24.0-3
    • 1.24.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:26.10

    Versions
    • 1.25.1-1
    • 1.25.2-1
    • 1.25.2-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:26.04:LTS

    Versions
    • 1.24.1-1
    • 1.25.0-2
    • 1.25.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →