CVE-2026-6665

—

CVSS 3.1

9.8 critical

EPSS

<1%p31

Published

May 9, 2026 (May 9, 2026)

Modified

Jul 24, 2026

Description

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.

Vendors: pgbouncer
Products: pgbouncer
Weakness: CWE-121
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.