CVE-2026-6669

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6669", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-04-20T12:25:47.129Z", "datePublished": "2026-09-23T16:04:47.824Z", "dateUpdated": "2026-09-23T16:46:13.708Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-09-23T16:04:47.824Z"}, "title": "Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer", "descriptions": [{"lang": "en", "value": "Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained."}], "affected": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"version": "0", "lessThanOrEqual": "1.25.2", "versionType": "semver", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-400", "type": "CWE", "description": "Uncontrolled Resource Consumption"}]}], "references": [{"url": "https://www.pgbouncer.org/changelog.html"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "configurations": [{"lang": "en", "value": "PgBouncer authenticates to a backend PostgreSQL server using SCRAM"}], "credits": [{"lang": "en", "value": "Thanks to @HarutoKimura for finding and reporting this issue.", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6669", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T16:33:29.069636Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T16:46:13.708Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6669", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T16:33:29.069636Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T16:36:50.297Z"}}], "cna": {"title": "Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer", "credits": [{"lang": "en", "type": "finder", "value": "Thanks to @HarutoKimura for finding and reporting this issue."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "n/a", "product": "PgBouncer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.25.2"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.pgbouncer.org/changelog.html"}], "descriptions": [{"lang": "en", "value": "Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "Uncontrolled Resource Consumption"}]}], "configurations": [{"lang": "en", "value": "PgBouncer authenticates to a backend PostgreSQL server using SCRAM"}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-09-23T16:04:47.824Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6669", "state": "PUBLISHED", "dateUpdated": "2026-09-23T16:46:13.708Z", "dateReserved": "2026-04-20T12:25:47.129Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-09-23T16:04:47.824Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"lessThanOrEqual": "1.25.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained."}], "id": "CVE-2026-6669", "lastModified": "2026-09-23T19:40:10.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6669", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-23T16:33:29.069636Z", "version": "2.0.3"}}]}, "published": "2026-09-23T17:17:16.223", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.pgbouncer.org/changelog.html"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "pgbouncer: PgBouncer: Denial of Service via unbounded SCRAM iteration count", "id": "2539546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539546"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["A flaw was found in PgBouncer. A malicious or compromised PostgreSQL backend can exploit a missing upper bound on the key derivation iteration count during SCRAM (Salted Challenge Response Authentication Mechanism) authentication. This can lead to uncontrolled CPU consumption in PgBouncer, effectively stopping it from serving traffic for all other databases and clients it manages. This results in a Denial of Service (DoS) for all connected services."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that PgBouncer is configured to connect only to trusted and secured PostgreSQL backend servers. Restricting PgBouncer's access to untrusted or potentially compromised backends reduces the risk of a denial of service attack via unbounded SCRAM iteration counts."}, "name": "CVE-2026-6669", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "pgbouncer", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-23T16:04:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-6669\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-6669\nhttps://www.pgbouncer.org/changelog.html"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.25.2]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PgBouncer", "source": "cna", "vendor": "n/a"}, "product": "pgbouncer", "vendor": "pgbouncer"}], "created": "2026-09-23T18:15:07.179503+00:00", "updated": "2026-09-24T02:00:14.509626+00:00", "vendors": ["pgbouncer", "pgbouncer$PRODUCT$pgbouncer"]}