The vulnerability is an integer overflow in the network packet parsing logic of PgBouncer before version 1.25.2. When a malformed SCRAM authentication packet is received, the boundary check is bypassed and the process crashes. This flaw is classified as CWE‑190 – Integer Overflow or Wraparound. The impact is a loss of service: PgBouncer terminates, potentially disrupting database connections for all clients that rely on it. There is no direct evidence of data exfiltration or privilege escalation; the flaw chiefly allows attackers to cause a service‑level denial of service.

PgBouncer deployments running any version prior to 1.25.2 are affected. This includes 1.24.x and older releases. The issue manifests during network packet parsing for client authentication, specifically when SCRAM authentication is enabled.

The CVSS score of 7.5 indicates a high severity DoS potential. EPSS is not available, so the likelihood of exploitation in the wild is unknown, but the flaw can be triggered remotely by an unauthenticated attacker who can send a crafted packet to the listening port. As it is not listed in CISA's KEV catalog, there is no current evidence of widespread exploitation. Attackers do not need elevated privileges; simply interacting with the PgBouncer service over the network suffices to cause the crash.