Vulnerability · Published Sep 23, 2026 · Assigned by PostgreSQL
CVE-2026-6669Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
Medium 5.9
In plain English
A medium-severity uncontrolled resource consumption in PgBouncer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | pgbouncer | no fix listed | DEBIAN-CVE-2026-6669 |
| Debian:13 | pgbouncer | no fix listed | DEBIAN-CVE-2026-6669 |
| Debian:14 | pgbouncer | 1.26.0-1 | DEBIAN-CVE-2026-6669 |
| Ubuntu:22.04:LTS | pgbouncer | no fix listed | UBUNTU-CVE-2026-6669 |
| Ubuntu:24.04:LTS | pgbouncer | no fix listed | UBUNTU-CVE-2026-6669 |
| Ubuntu:26.04:LTS | pgbouncer | no fix listed | UBUNTU-CVE-2026-6669 |
| Ubuntu:26.10 | pgbouncer | no fix listed | UBUNTU-CVE-2026-6669 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H