CVE-2026-19888

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.3

Description An issue exists in the SCRAM (Salted Challenge Response Authentication Mechanism) client-final-message parser. The parser fails to validate a mandatory attribute, which can lead to a NULL pointer dereference when a required value remains unset despite the parser reporting success. A remote unauthenticated attacker can exploit this by sending a malformed message, causing the process to crash. Since the software serves all clients from a single process, this results in a denial of service that terminates all pooled connections.

Recommendations Update to version 1.25.3 or later.