Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-09 | 1 | General1 |
| 2026-05-10 | 3 | Disclosure3 |
| 2026-05-11 | 1 | Patch1 |
PgBouncer 1.25.2 released - Human touch with fresh twist in title race full of uncertainties (including CVE-2026-6664, CVE-2026-6665, Fix CVE-2026-6666, CVE-2026-6667) https://www.pgbouncer.org/changelog.html#pgbouncer-125x
Post summary
The post announces the release of PgBouncer 1.25.2, noting that it contains fixes for several CVEs, but provides no PoC, exploit details, or active exploitation evidence.
🚨 High severity vulnerabilities disclosed in PgBouncer SCRAM authentication handling • CVE-2026-6664 - integer overflow in packet parsing can let an unauthenticated attacker crash PgBouncer using malformed SCRAM authentication packets • CVE-2026-6665 - malicious backend responses can trigger a stack overflow during SCRAM message handling Affected versions: < 1.25.2 👉 Users running exposed PgBouncer instances may want to review and update their deployments to version 1.25.2
Post summary
The post announces high‑severity vulnerabilities in PgBouncer’s SCRAM handling, details the nature of the flaws, and recommends updating to version 1.25.2.
PgBouncer'ın SCRAM authentication'ında buffer overflow var. Veritabanına girmek için şifre kırmaya gerek yok, authentication mekanizmasının kendisi seni içeri alıyor. Kapıya kilidi takan usta kilidi açık bırakmış. CVE-2026-6665 🔓
Post summary
The post announces that CVE‑2026‑6665 is a buffer overflow in PgBouncer’s SCRAM authentication, allowing database access without password cracking, but provides no PoC, patch, or evidence of active exploitation.
⚡ New CVE Alert: CVE-2026-6665 📊 Severity: 8.1 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-6665 #CVE-2026-6665 #CVE #High #CyberSecurity #InfoSec https://t.co/XRtwhwJYEK
Post summary
The tweet announces CVE‑2026‑6665, noting its severity score of 8.1 and high risk, but provides no technical exploitation details or mitigation guidance.
CVE-2026-6665 Stack Overflow in PgBouncer SCRAM Authentication Before Version 1.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6665 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The text merely lists the CVE identifier and provides a link to a vulnerability details page, with no further technical or exploitation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pgbouncer | pgbouncer | - | - | - |