CVE-2026-6669— Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer

Quick assessment

Affected

n/a PgBouncer

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 PgBouncer 1.25.2 及更早版本中，SCRAM 认证过程中接受用于与后端服务器进行密钥派生的迭代次数缺乏上限约束。这使得恶意或已被攻陷的 PostgreSQL 后端能够通过指定极高的迭代次数，导致 PgBouncer 发生不可控的 CPU 资源消耗。由于此类密钥派生操作在前端构建（如 PgBouncer）中无法被中断，且 PgBouncer 以单进程模式服务所有客户端，因此一个后端的此类攻击行为可导致其停止为所有其他数据库和客户端提供流量服务，从而使得单个后端的故障未能被有效隔离。

CVSS 5.9 · Medium EPSS 0.42% · P37 Updated Sep 24, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

Vendor	Product	Version Range	Status
n/a	PgBouncer	`≤ 1.25.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer

Source: CVE Program / CVE List V5

Vulnerability Description

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

未加控制的资源消耗(资源穷尽)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	PgBouncer	0 ~ 1.25.2	-

II. Public POCs for CVE-2026-6669

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-6669

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-6669

Same Patch Batch · n/a · 2026-09-23 · 9 CVEs total

CVE-2026-6668	7.5 HIGH	Integer overflow causes an infinite loop in packet buffer growth in PgBouncer
CVE-2026-19888	7.5 HIGH	NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
CVE-2026-79304	6.5 MEDIUM	CyberPanel 1.9.1 路径遍历漏洞
CVE-2026-79306	6.5 MEDIUM	CyberPanel v1.9.1 文件管理器路径遍历漏洞
CVE-2026-95897	5.5 MEDIUM	Dask Loader core.py from_npy_stack deserialization
CVE-2026-96739	4.3 MEDIUM	SEMCMS KindEditor Upload upload_json.php cross site scripting
CVE-2026-79310		web.py 0.76 服务端模板注入漏洞
CVE-2025-63564		Moodle Socialwall 3.0-3.3 SQL注入漏洞

IV. Related Vulnerabilities

Same product: PgBouncer

Same vendor: n/a

Same weakness: CWE-400