Unrestricted Key Derivation in PgBouncer Affects PostgreSQL Backend Operations
CVE-2026-6669

5.9MEDIUM

Key Information:

Vendor

PostgreSQL
Status
Pgbouncer
Vendor
CVE Published:
23 September 2026

What is CVE-2026-6669?

A crucial security flaw has been identified in PgBouncer, specifically due to a missing upper limit on the key derivation iteration count during SCRAM authentication with PostgreSQL backends. This oversight permits a malicious or compromised PostgreSQL server to exploit the authentication process, leading to uncontrolled CPU consumption in the PgBouncer service. Since PgBouncer operates by serving all database clients from a single process, a successful attack on one backend can jeopardize the service for all other clients and databases it manages, causing significant operational disruptions.

Affected Version(s)

PgBouncer 0 <= 1.25.2

References

https://www.pgbouncer.org/changelog.html

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks to @HarutoKimura for finding and reporting this issue.
.