Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.
BIT-pgbouncer-2026-6669
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:BIT-pgbouncer-2026-6669
pgbouncer
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.26.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.0"
}
]
}
],
"package": {
"name": "pgbouncer",
"purl": "pkg:bitnami/pgbouncer",
"ecosystem": "Bitnami"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"database_specific": {
"source": "https://github.com/bitnami/vulndb/tree/main/data/pgbouncer/BIT-pgbouncer-2026-6669.json"
}
}
]- Related CVEs
- CVE-2026-6669
Source reference:
/aliases
Publisher severity
medium
Source reference: /database_specific/severity
- Event
- #59535 · Revision 1
- Added to Heist Feed
- Publisher date