Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-09 | 1 | Disclosure1 |
| 2026-05-10 | 2 | General1Patch1 |
| 2026-05-11 | 1 | Patch1 |
| 2026-05-20 | 2 | Active Exploitation1Disclosure1 |
PgBouncer 1.25.2 released - Human touch with fresh twist in title race full of uncertainties (including CVE-2026-6664, CVE-2026-6665, Fix CVE-2026-6666, CVE-2026-6667) https://www.pgbouncer.org/changelog.html#pgbouncer-125x
Post summary
PgBouncer 1.25.2 release notes announce fixes for CVE-2026-6664, 6665, 6666, and 6667, indicating a patch was applied, but no additional technical details or exploitation evidence are presented.
Warning: High Integer Overflow in #PgBouncer. #CVE-2026-6664 CVSS: 7.5 It's actively exploited by unauthenticated network-based attackers who can cause system crash. #Patch #Patch #Patch
Post summary
CVE-2026-6664 describes a high integer overflow in PgBouncer that is being actively exploited by unauthenticated attackers, leading to system crashes; no patch details are provided.
BREAKING: Critical PgBouncer bug CVE-2026-6664 lets unauthenticated remote attackers crash services in all versions before 1.25.2 via malformed SCRAM auth packets. https://threatcluster.io/cluster/critical-integer-overflow-vulnerability-in-pgbouncer-cve-202-59f90e53
Post summary
Announcement of a critical vulnerability in PgBouncer (CVE-2026-6664) that permits unauthenticated remote attackers to crash the service via malformed SCRAM authentication packets.
🚨 High severity vulnerabilities disclosed in PgBouncer SCRAM authentication handling • CVE-2026-6664 - integer overflow in packet parsing can let an unauthenticated attacker crash PgBouncer using malformed SCRAM authentication packets • CVE-2026-6665 - malicious backend responses can trigger a stack overflow during SCRAM message handling Affected versions: < 1.25.2 👉 Users running exposed PgBouncer instances may want to review and update their deployments to version 1.25.2
Post summary
The tweet highlights two high‑severity bugs in PgBouncer’s SCRAM handling and urges users to patch to version 1.25.2.
⚡ New CVE Alert: CVE-2026-6664 📊 Severity: 7.5 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-6664 #CVE-2026-6664 #CVE #High #CyberSecurity #InfoSec https://t.co/vshicmd6X1
Post summary
The tweet announces CVE-2026-6664 with a severity score and general impact, but lacks technical, exploit, patch, or active exploitation details.
CVE-2026-6664 Integer Overflow in PgBouncer Before 1.25.2 Causes Remote Denial of Service https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6664
Post summary
The text announces CVE-2026-6664, describing an integer overflow in PgBouncer that leads to remote denial of service but provides no exploit code, patch information, or evidence of active attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pgbouncer | pgbouncer | - | - | - |