p PatchFirst

CVE-2026-6669

CVE-2026-6669 · Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.

CVSS 5.9 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • pgbouncer

    Versions
    • ≥ 0, ≤ 1.25.2: Affected (semver)

    No fix published

  • pgbouncer Debian:12

    Versions
    • 1.18.0-1
    • 1.18.0-1+deb12u1
    • 1.19.0-1
    • 1.19.1-1
    • 1.20.0-1
    • 1.20.1-1
    • 1.21.0-1
    • 1.22.0-1
    • 1.22.1-1
    • 1.23.0-1
    • 1.23.1-1
    • 1.24.0-2
    • 1.24.0-3
    • 1.24.1-1
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.1-1
    • 1.25.2-1
    • 1.26.0-1
    • 1.26.0-2
    • 1.26.0-3
    • 1.26.0-4
    • 1.26.0-5
    • 1.26.0-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Debian:13

    Versions
    • 1.24.1-1
    • 1.24.1-1+deb13u1
    • 1.24.1-1+deb13u2
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.1-1
    • 1.25.2-1
    • 1.26.0-1
    • 1.26.0-2
    • 1.26.0-3
    • 1.26.0-4
    • 1.26.0-5
    • 1.26.0-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Debian:14

    Versions
    • 1.24.1-1
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.1-1
    • 1.25.2-1
    Affected ranges
    • ECOSYSTEM: < 1.26.0-1

    Update to 1.26.0-1

  • pgbouncer Ubuntu:16.04:LTS

    Versions
    • 1.5.5-1
    • 1.6.1-1
    • 1.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:18.04:LTS

    Versions
    • 1.7.2-3build1
    • 1.7.2-65-g2b8e6cf-1
    • 1.8.1-1
    • 1.8.1-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:20.04:LTS

    Versions
    • 1.10.0-1
    • 1.10.0-1build1
    • 1.11.0-1
    • 1.12.0-2
    • 1.12.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:22.04:LTS

    Versions
    • 1.15.0-1
    • 1.16.1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:24.04:LTS

    Versions
    • 1.20.0-1
    • 1.21.0-1
    • 1.22.0-1
    • 1.22.0-1build1
    • 1.22.0-1build3
    • 1.22.0-1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:26.10

    Versions
    • 1.25.1-1
    • 1.25.2-1
    • 1.25.2-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:26.04:LTS

    Versions
    • 1.24.1-1
    • 1.25.0-2
    • 1.25.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →