CVE-2026-6669— Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
Quick assessment
Affected
n/a PgBouncer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resultin
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-6669
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
Source: CVE Program / CVE List V5
Vulnerability Description
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | PgBouncer | 0 ~ 1.25.2 | - |
|
II. Public POCs for CVE-2026-6669
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6669
请登录查看更多情报信息。
Same Patch Batch · n/a · 2026-09-23 · 8 CVEs total
| CVE-2026-19888 | 7.5 HIGH | NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer |
| CVE-2026-6668 | 7.5 HIGH | Integer overflow causes an infinite loop in packet buffer growth in PgBouncer |
| CVE-2026-79304 | 6.5 MEDIUM | CVE-2026-79304 |
| CVE-2026-79306 | 6.5 MEDIUM | CVE-2026-79306 |
| CVE-2026-95897 | 5.5 MEDIUM | Dask Loader core.py from_npy_stack deserialization |
| CVE-2026-79310 | CVE-2026-79310 | |
| CVE-2025-63564 | CVE-2025-63564 |
IV. Related Vulnerabilities
Same product: PgBouncer
-
CVE-2026-19888
NULL pointer dereference in SCRAM client-final-message parsi -
CVE-2026-6668
Integer overflow causes an infinite loop in packet buffer gr -
CVE-2026-6667
PgBouncer missing authorization check in KILL_CLIENT admin c -
CVE-2026-6666
PgBouncer crash in kill_pool_logins_server_error -
CVE-2026-6665
PgBouncer buffer overflow in SCRAM
Same weakness: CWE-400
-
CVE-2026-61814
Jawn: Quadratic parsing effort in AsyncParser -
CVE-2026-96541
Gnome-remote-desktop: gnome-remote-desktop: unauthenticated -
CVE-2026-77791
Apache Tomcat: DoS via busy wait during WebSocket close -
CVE-2026-91777
jackson-databind: quadratic forward-reference completion in -
CVE-2026-91776
jackson-databind: unbounded growth of the type id cache in T
V. Comments for CVE-2026-6669
No comments yet