PgBouncer versions prior to 1.25.2 contain a buffer overflow in the SCRAM client-final-message construction. The flaw arises when the return value of strlcat() is incorrectly interpreted, allowing a backend that issues a very long SCRAM server‑final‑message to overflow the stack. An attacker who can supply such a message can potentially overwrite critical stack data, leading to arbitrary code execution or a denial‑of‑service event on the PgBouncer instance. The weakness is a classic stack buffer overflow (CWE‑121).

The vulnerability affects PgBouncer prior to version 1.25.2. Any deployment using PgBouncer 1.25.1 or earlier that employs SCRAM authentication with a PostgreSQL backend is potentially exposed. The issue is resolved in PgBouncer 1.25.2 and later releases.

With a CVSS score of 8.1 the vulnerability is considered high severity. No EPSS data is available and the flaw is not listed in CISA's KEV catalog. Exploitation requires the attacker to have control over or influence the PostgreSQL backend to send a crafted SCRAM server‑final‑message; thus it is most relevant in environments where PgBouncer connects to a backend that may be compromised or mal‑configured. If that precondition is met, the flaw can lead to arbitrary code execution on the PgBouncer host.