CVE-2026-6665

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6665", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-04-20T12:25:43.793Z", "datePublished": "2026-05-09T00:43:46.762Z", "dateUpdated": "2026-05-12T03:55:19.823Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-05-09T00:43:46.762Z"}, "title": "PgBouncer buffer overflow in SCRAM", "descriptions": [{"lang": "en", "value": "The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow."}], "affected": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"lessThan": "1.25.2", "version": "0", "versionType": "semver", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-121", "type": "CWE", "description": "Stack-based Buffer Overflow"}]}], "references": [{"url": "https://www.pgbouncer.org/changelog.html#pgbouncer-125x"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "value": "Thanks to HarutoKimura for finding and reporting this problem.", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-6665"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T03:55:19.823Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6665", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-04-20T12:25:43.793Z", "datePublished": "2026-05-09T00:43:46.762Z", "dateUpdated": "2026-05-11T14:43:19.321Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-05-09T00:43:46.762Z"}, "title": "PgBouncer buffer overflow in SCRAM", "descriptions": [{"lang": "en", "value": "The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow."}], "affected": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"lessThan": "1.25.2", "version": "0", "versionType": "semver", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-121", "type": "CWE", "description": "Stack-based Buffer Overflow"}]}], "references": [{"url": "https://www.pgbouncer.org/changelog.html#pgbouncer-125x"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "value": "Thanks to HarutoKimura for finding and reporting this problem.", "type": "finder"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6665", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-11T14:43:09.969079Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T14:43:15.305Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"lessThan": "1.25.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pgbouncer:pgbouncer:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC45BB66-2289-466A-BC28-113710202BA5", "versionEndExcluding": "1.25.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow."}, {"lang": "es", "value": "El c\u00f3digo SCRAM en PgBouncer anterior a la versi\u00f3n 1.25.2 no verificaba correctamente el valor de retorno de strlcat() al construir el contenido del mensaje final del cliente SCRAM. Un backend malicioso que env\u00eda un mensaje final del servidor SCRAM con un nonce largo puede desencadenar un desbordamiento de pila."}], "id": "CVE-2026-6665", "lastModified": "2026-07-24T08:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6665", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-05-09T01:16:09.013", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Release Notes"], "url": "https://www.pgbouncer.org/changelog.html#pgbouncer-125x"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.25.2)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PgBouncer", "source": "cna", "vendor": "n/a"}, "product": "pgbouncer", "vendor": "pgbouncer"}], "created": "2026-05-09T02:30:16.161754+00:00", "updated": "2026-05-09T03:30:24.687700+00:00", "vendors": ["pgbouncer", "pgbouncer$PRODUCT$pgbouncer"]}