CVE-2026-19888
Received Received - Intake

SCRAM Parser NULL Pointer Dereference in PgBouncer

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: PostgreSQL

Description
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-19888
EUVD
EUVD-2026-85365

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pgbouncer pgbouncer to 1.25.2 (inc)
pgbouncer pgbouncer 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in PgBouncer through version 1.25.2 involves missing validation of a mandatory attribute in the SCRAM client-final-message parser. An unauthenticated remote attacker can send a malformed message that tricks the parser into reporting success while leaving a required value unset. This unset value is then dereferenced as a NULL pointer, causing the process to crash.

Detection Guidance

This vulnerability causes PgBouncer to crash when processing a malformed SCRAM client-final-message. To detect it, monitor PgBouncer logs for crashes or segmentation faults. Check if the process terminates unexpectedly during authentication attempts. No specific commands are provided for detection as the issue is triggered by malformed input rather than a persistent state.

Impact Analysis

The crash terminates every pooled connection because PgBouncer serves all clients from a single process. This results in a denial of service, disrupting database access for all users relying on the affected PgBouncer instance.

Compliance Impact

This vulnerability causes a denial-of-service (DoS) condition by crashing the PgBouncer process, terminating all pooled connections. For GDPR, this could disrupt data processing operations, potentially violating availability requirements. For HIPAA, it may impact access to protected health information if pooled connections are terminated during critical operations.

Mitigation Strategies

Upgrade PgBouncer to a version later than 1.25.2 where the SCRAM client-final-message parser validation issue is fixed. If immediate upgrade is not possible, restrict network access to PgBouncer to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19888. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart