CVE catalog

CVE-2026-6669

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to c

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.42% · Oct 25, 2026

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpgbouncersid1.26.1-1fixed
Debianpgbouncerforky1.26.1-1fixed
Debianpgbouncertrixie1.24.1-1+deb13u2vulnerable
Debianpgbouncerbookworm1.18.0-1+deb12u1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpgbouncersourcesid1.26.0-1not yet assignedNot reported[1148946]
Debianpgbouncersourceforky1.26.0-1not yet assignedNot reported[1148946]
Debianpgbouncersourcetrixie(unfixed)not yet assignedNot reported[1148946]
Debianpgbouncersourcebookworm(unfixed)not yet assignedNot reported[1148946]

[Debian bug #1148946]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [pgbouncer]Affected
    Details (2)

    • 1.18.0-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · pgbouncer · debian · bookworm; nvd · pgbouncer · debian · 12

    • 1.18.0-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · pgbouncer · debian · bookworm; nvd · pgbouncer · debian · 12

[Debian 13 (Trixie)]

  • [pgbouncer]Affected
    Details (2)

    • 1.24.1-1+deb13u2 · amd64 · trixie

      Affected

      nvd · pgbouncer · debian · 13

    • 1.24.1-1+deb13u2 · arm64 · trixie

      Affected

      nvd · pgbouncer · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]