CVE-2026-6669
Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.
| CWE | CWE-400 |
| Vendor | n/a |
| Product | pgbouncer |
| Published | Sep 23, 2026 |
| Last Updated | Sep 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a pgbouncer
Be the first to know when new medium vulnerabilities affecting n/a pgbouncer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / PgBouncer
0 ≤ 1.25.2
Credits
Thanks to @HarutoKimura for finding and reporting this issue.