Description
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
Published: 2026-09-23
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Remote crash / denial of service via NULL pointer dereference
Action: Apply Workaround
AI Analysis

Impact

An unauthenticated attacker can send a malformed SCRAM client-final-message to a vulnerable PgBouncer instance. The parser fails to validate a required attribute, reports success, and later dereferences an unset pointer, causing the process to terminate. No credentials are required and the crash occurs before any authentication step, so no accounts are compromised.

Affected Systems

All PgBouncer deployments running version 1.25.2 or earlier are affected.

Risk and Exploitability

The CVSS score of 7.5 indicates significant impact. With no known KEV listing and EPSS information unavailable, the exact exploitation frequency is unclear, but the path is simple and requires network connectivity to the PgBouncer listener. A single crafted message can crash the entire process, terminating all pooled connections and effectively denying service to all clients.

Generated by OpenCVE AI on September 23, 2026 at 17:38 UTC.

Remediation

Vendor Workaround

Restrict network access to the PgBouncer listener to trusted clients. No configuration change avoids the issue for deployments that must accept SCRAM authentication from untrusted networks, because the crash occurs before any credential is verified and PgBouncer performs a mock SCRAM exchange even for users that do not exist.

OpenCVE Recommended Actions

  • Restrict network access to the PgBouncer listener so that only trusted clients can reach it; a firewall or binding to a localhost interface is recommended.
  • Upgrade PgBouncer to a version that includes the fix for the SCRAM client-final-message parser; check the official release notes for the patch release.
  • Once a patch is available, replace the vulnerable binary, restart PgBouncer, and verify that the listener is no longer exposed to untrusted networks.

Generated by OpenCVE AI on September 23, 2026 at 17:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.pgbouncer.org/changelog.html cve-icon cve-icon
History

Wed, 23 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Pgbouncer
Pgbouncer pgbouncer
Vendors & Products Pgbouncer
Pgbouncer pgbouncer

Wed, 23 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
Title NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Pgbouncer Pgbouncer
cve-icon MITRE

Status: PUBLISHED

Assigner: PostgreSQL

Published:

Updated: 2026-09-23T16:46:13.585Z

Reserved: 2026-08-14T16:55:37.365Z

Link: CVE-2026-19888

cve-icon Vulnrichment

Updated: 2026-09-23T16:36:44.516Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T17:17:14.917

Modified: 2026-09-23T19:40:10.000

Link: CVE-2026-19888

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T18:30:06Z

Weaknesses