CVE-2026-6668

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.3

Description An integer overflow exists in the packet buffer growth logic. When processing sufficiently large input, the buffer size computation overflows, causing a growth loop that cannot terminate. Since the software serves all clients from a single process, this condition saturates a CPU core and stalls every pooled connection, leading to a denial of service. This issue can be triggered by both unauthenticated and authenticated remote attackers.

Recommendations Update to version 1.25.3 or later.