The vulnerability is a null pointer dereference that occurs in PgBouncer’s "kill_pool_logins_server_error" routine when a server returns an error response lacking an SQLSTATE field. This flaw can terminate the PgBouncer process, causing a denial of service. The weakness is classified as CWE‑476, indicating an improper null dereference. The impact is limited to availability disruption; confidentiality or integrity is not compromised.

The affected product is PgBouncer, as identified by the CNA. Versions prior to 1.25.2 are vulnerable. Affected users running any 1.24.x, 1.25.x, or older releases should verify their current version.

With a CVSS score of 5.9, the vulnerability carries a moderate severity rating. EPSS data are not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector involves a server intentionally or unintentionally sending an error response without an SQLSTATE field, which is plausible in a misconfigured or faulty backend. Because the flaw only leads to a crash, it does not provide code execution or data exfiltration, but it can still disrupt service continuity for all connected clients.