CVE-2026-6669

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.3

Description PgBouncer is subject to uncontrolled CPU consumption during SCRAM (Salted Challenge Response Authentication Mechanism) authentication to a backend server. This occurs because there is no upper bound on the key derivation iteration count accepted from the backend. Since PgBouncer operates as a single process to serve all clients, a malicious or compromised PostgreSQL backend can trigger an uninterruptible key derivation process, preventing the software from serving traffic for all other pooled databases and clients, leading to a denial of service.

Recommendations Update to version 1.25.3 or later.