CVE-2026-6669
Received Received - Intake

Denial of Service in PgBouncer via SCRAM Key Derivation

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: PostgreSQL

Description
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-6669
EUVD
EUVD-2026-85364

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pgbouncer pgbouncer 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a missing upper limit on the key derivation iteration count during SCRAM authentication in PgBouncer versions up to 1.25.2. A malicious or compromised PostgreSQL backend can exploit this to cause excessive CPU usage in PgBouncer by forcing it to perform an unbounded number of key derivation iterations.

Detection Guidance

This vulnerability involves uncontrolled CPU consumption in PgBouncer due to missing upper bound on key derivation iteration count during SCRAM authentication. To detect it, monitor PgBouncer's CPU usage and check for backend servers sending unusually high iteration counts. Look for processes consuming excessive CPU resources or connections with abnormally high authentication attempts.

Impact Analysis

This vulnerability can cause PgBouncer to become unresponsive or crash due to high CPU consumption. Since PgBouncer handles all client connections in a single process, a single compromised backend can disrupt service for all other databases and clients it manages, leading to widespread service outages.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires ensuring availability of processing systems, while HIPAA mandates safeguards against unauthorized disruption. The CPU exhaustion flaw in PgBouncer could violate these requirements by making database services unavailable to all clients.

Mitigation Strategies

Upgrade PgBouncer to version 1.25.3 or later to address the missing upper bound on key derivation iteration count in SCRAM authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6669. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart