CVE-2026-6668

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6668", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-04-20T12:25:46.351Z", "datePublished": "2026-09-23T16:04:47.158Z", "dateUpdated": "2026-09-23T16:46:13.834Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-09-23T16:04:47.158Z"}, "title": "Integer overflow causes an infinite loop in packet buffer growth in PgBouncer", "descriptions": [{"lang": "en", "value": "Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is killed. Both unauthenticated and authenticated code paths can reach the overflow."}], "affected": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"version": "0", "lessThanOrEqual": "1.25.2", "versionType": "semver", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-190", "type": "CWE", "description": "Integer Overflow or Wraparound"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-835", "type": "CWE", "description": "Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "references": [{"url": "https://www.pgbouncer.org/changelog.html"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "max_packet_size is left at its default of 2147483647 (default configuration), which is what permits a packet large enough to reach the overflow. No other non-default configuration is required."}], "workarounds": [{"lang": "en", "value": "Set max_packet_size well below 1073741824 so that no single packet can grow a packet buffer past the overflow threshold"}], "credits": [{"lang": "en", "value": "Thanks to @var77 for finding and reporting this issue.", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6668", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T16:33:22.320321Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T16:46:13.834Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6668", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T16:33:22.320321Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T16:36:55.619Z"}}], "cna": {"title": "Integer overflow causes an infinite loop in packet buffer growth in PgBouncer", "credits": [{"lang": "en", "type": "finder", "value": "Thanks to @var77 for finding and reporting this issue."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "n/a", "product": "PgBouncer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.25.2"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.pgbouncer.org/changelog.html"}], "workarounds": [{"lang": "en", "value": "Set max_packet_size well below 1073741824 so that no single packet can grow a packet buffer past the overflow threshold"}], "descriptions": [{"lang": "en", "value": "Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is killed. Both unauthenticated and authenticated code paths can reach the overflow."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "configurations": [{"lang": "en", "value": "max_packet_size is left at its default of 2147483647 (default configuration), which is what permits a packet large enough to reach the overflow. No other non-default configuration is required."}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-09-23T16:04:47.158Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6668", "state": "PUBLISHED", "dateUpdated": "2026-09-23T16:46:13.834Z", "dateReserved": "2026-04-20T12:25:46.351Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-09-23T16:04:47.158Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"lessThanOrEqual": "1.25.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is killed. Both unauthenticated and authenticated code paths can reach the overflow."}], "id": "CVE-2026-6668", "lastModified": "2026-09-23T19:40:10.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6668", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-23T16:33:22.320321Z", "version": "2.0.3"}}]}, "published": "2026-09-23T17:17:16.073", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.pgbouncer.org/changelog.html"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-835"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "pgbouncer: PgBouncer: Denial of Service via integer overflow in packet buffer growth", "id": "2539548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539548"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in PgBouncer. An unauthenticated remote attacker can exploit an integer overflow in the packet buffer growth logic by providing sufficiently large input. This causes the buffer size computation to overflow, leading to an infinite loop. As a result, a CPU core is saturated, and all pooled connections are stalled, causing a Denial of Service."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network access to the PgBouncer service to only trusted clients or the local host. This can be achieved by configuring firewall rules to limit incoming connections to the PgBouncer port. Ensure that any changes to network configurations are applied and services are reloaded or restarted as necessary, which may temporarily disrupt existing connections."}, "name": "CVE-2026-6668", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "pgbouncer", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-23T16:04:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-6668\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-6668\nhttps://www.pgbouncer.org/changelog.html"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.25.2]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PgBouncer", "source": "cna", "vendor": "n/a"}, "product": "pgbouncer", "vendor": "pgbouncer"}], "created": "2026-09-23T18:15:07.179811+00:00", "updated": "2026-09-23T18:30:06.736528+00:00", "vendors": ["pgbouncer", "pgbouncer$PRODUCT$pgbouncer"]}