CVE-2026-6668— Integer overflow causes an infinite loop in packet buffer growth in PgBouncer

Quick assessment

Affected

n/a PgBouncer

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PgBouncer 1.25.2 及之前版本中，数据包缓冲区增长逻辑存在整数溢出漏洞，允许未经身份验证的远程攻击者发起拒绝服务（DoS）攻击。当输入数据足够大时，缓冲区大小的计算会发生整数溢出，导致缓冲区扩展逻辑无法终止。由于 PgBouncer 使用单一进程服务所有客户端，此漏洞会导致 CPU 核心资源被耗尽，并使所有连接池中的连接陷入停滞状态，直到该进程被强制终止。无论是否经过身份验证，攻击者均可触发该溢出漏洞。

CVSS 7.5 · High EPSS 0.57% · P48 Updated Sep 24, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

Vendor	Product	Version Range	Status
n/a	PgBouncer	`≤ 1.25.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Integer overflow causes an infinite loop in packet buffer growth in PgBouncer

Source: CVE Program / CVE List V5

Vulnerability Description

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is killed. Both unauthenticated and authenticated code paths can reach the overflow.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

整数溢出或超界折返

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	PgBouncer	0 ~ 1.25.2	-

II. Public POCs for CVE-2026-6668

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-6668

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-6668

Same Patch Batch · n/a · 2026-09-23 · 9 CVEs total

CVE-2026-19888	7.5 HIGH	NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
CVE-2026-79304	6.5 MEDIUM	CyberPanel 1.9.1 路径遍历漏洞
CVE-2026-79306	6.5 MEDIUM	CyberPanel v1.9.1 文件管理器路径遍历漏洞
CVE-2026-6669	5.9 MEDIUM	Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
CVE-2026-95897	5.5 MEDIUM	Dask Loader core.py from_npy_stack deserialization
CVE-2026-96739	4.3 MEDIUM	SEMCMS KindEditor Upload upload_json.php cross site scripting
CVE-2026-79310		web.py 0.76 服务端模板注入漏洞
CVE-2025-63564		Moodle Socialwall 3.0-3.3 SQL注入漏洞

IV. Related Vulnerabilities

Same product: PgBouncer

Same vendor: n/a

Same weakness: CWE-190