Security Advisory

CVE-2026-6665

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-09 00:43:46

Last updated 2026-05-12 03:55:19

Assigner PostgreSQL

CVSS score 8.1

State PUBLISHED

Description

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.

← Browse all CVEs View on cve.org ↗