Brief Summary: PgBouncer CVE-2026-6665 SCRAM Authentication Stack Overflow via Malicious Backend Nonce

Introduction

A missing bounds check in PgBouncer's SCRAM authentication code lets a rogue PostgreSQL backend corrupt the connection pooler's stack simply by replying with an oversized nonce during the authentication handshake. This CVSS 8.1 flaw (CVE-2026-6665) deserves prompt attention from any organization that routes database traffic through PgBouncer, and that includes cloud providers like Neon and Aiven.

PgBouncer is an open-source, lightweight connection pooler built for PostgreSQL. Many high-scale database architectures are built around it, because it lets applications multiplex thousands of client connections over a smaller pool of actual backend connections. Neon, for instance, uses PgBouncer to support up to 10,000 concurrent connections per compute unit, and Aiven integrates it across its managed PostgreSQL offerings.

Technical Information

Root Cause

The bug is in how PgBouncer builds the SCRAM client final message when it authenticates with a PostgreSQL backend. PgBouncer uses strlcat() to concatenate strings, including the server-supplied nonce, into a stack-allocated buffer. By design, strlcat() returns the total length of the string it tried to create. If that value exceeds the size of the destination buffer, truncation has occurred, and the caller is expected to handle the overflow condition.

PgBouncer versions before 1.25.2 do not check the return value of strlcat() correctly. The code carries on as if the concatenation succeeded even when the data exceeds the buffer boundary, and the result is a classic stack-based buffer overflow (CWE-121).

Attack Flow

Exploitation proceeds in five steps:

1. The attacker compromises an existing PostgreSQL backend, or provisions a malicious one, that PgBouncer is configured to connect to. This is a realistic scenario in multi-tenant environments, on shared hosting platforms, and wherever backend connection strings are configured dynamically.

2. PgBouncer starts a SCRAM authentication exchange with the malicious backend. SCRAM, in the form of SCRAM SHA 256, is the default authentication mechanism for modern PostgreSQL deployments.

3. The backend replies with a SCRAM server final message that contains an excessively long nonce. In SCRAM, the server extends the nonce from the client-supplied value, and the protocol itself sets no strict upper bound on nonce length.

4. PgBouncer calls strlcat() to append the oversized nonce to the stack-allocated buffer for the client final message. Because nothing validates the return value, the write runs past the buffer boundary and corrupts adjacent stack memory.

5. Depending on the stack layout and platform protections, the corruption could cause a crash (denial of service), or potentially control-flow hijacking if the attacker can carefully craft the nonce contents.

Relationship to CVE-2026-6664

The same PgBouncer 1.25.2 release also fixes CVE-2026-6664, an integer overflow in network packet parsing that lets an unauthenticated remote attacker crash PgBouncer with a malformed SCRAM authentication packet. The two vulnerabilities share the SCRAM authentication code path, but they have distinct root causes and threat models. CVE-2026-6664 does not require backend control, and any unauthenticated network peer can trigger it. That makes the pair of flaws particularly concerning when considered together.

Affected Systems and Versions

All versions of PgBouncer prior to 1.25.2 are affected. The trigger condition is PgBouncer authenticating to a backend using SCRAM (SCRAM SHA 256).

Current packaging status by distribution channel:

Organizations that rely on Oracle Linux or Debian packages should watch their repositories for updates, or consider building PgBouncer 1.25.2 from source.

Vendor Security History

PgBouncer 1.25.2 fixes two distinct memory corruption vulnerabilities in the SCRAM authentication path at once: CVE-2026-6665 (this stack overflow) and CVE-2026-6664 (an integer overflow in packet parsing). Multiple memory-safety bugs in the same authentication code path suggest that this part of the codebase had not had a thorough security review before. The PgBouncer project keeps an active changelog and responds to security disclosures. Even so, organizations that depend on PgBouncer as a security boundary between clients and backends should note that these flaws clustered in a single release.

References

• PgBouncer Changelog: 1.25.x
• PgBouncer Official Site
• NVD Vulnerability Database
• CVE.org
• PgBouncer Homebrew Formula
• Debian Trixie PgBouncer Package
• Oracle Linux Yum: What's New
• Neon: Connection Pooling Documentation
• Aiven: Enhanced Password Security with SCRAM SHA 256
• PgBouncer 1.25.x Docker Hardened Image (fips)