Medium
pgbouncer — security advisory
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.
- Products
- pgbouncer
- Affected versions
- 1.10.0-1, 1.10.0-1build1, 1.11.0-1, 1.12.0-2, 1.12.0-3, 1.15.0-1, 1.16.1-1ubuntu1, 1.20.0-1, 1.21.0-1, 1.22.0-1, 1.22.0-1build1, 1.22.0-1build3, 1.22.0-1build4, 1.24.1-1, 1.25.0-2, 1.25.1-1, 1.25.2-1, 1.25.2-1ubuntu1, 1.5.5-1, 1.6.1-1, 1.7-1, 1.7.2-3build1, 1.7.2-65-g2b8e6cf-1, 1.8.1-1, 1.8.1-1build1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-6669
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:10 UTC · Revision 1
Source evidence
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.
osv:UBUNTU-CVE-2026-6669
pgbouncer
Fixed versions: Not specified
pgbouncer
Fixed versions: Not specified
pgbouncer
Fixed versions: Not specified
pgbouncer
Fixed versions: Not specified
pgbouncer
Fixed versions: Not specified
pgbouncer
Fixed versions: Not specified
pgbouncer
Fixed versions: Not specified
Complete source record
{
"id": "de6c413f636178c6fac25917bc555e23300637cec5628341493c751a38bbc588",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-6669",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-6669",
"summary": "Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained.",
"evidence": "osv:UBUNTU-CVE-2026-6669",
"products": [
{
"name": {
"value": "pgbouncer",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.7-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "pgbouncer",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7.2-3build1",
"evidence": "/affected/1/versions"
},
{
"value": "1.7.2-65-g2b8e6cf-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.8.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.8.1-1build1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "pgbouncer",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.10.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.10.0-1build1",
"evidence": "/affected/2/versions"
},
{
"value": "1.11.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.12.0-2",
"evidence": "/affected/2/versions"
},
{
"value": "1.12.0-3",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "pgbouncer",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.15.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "1.16.1-1ubuntu1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "pgbouncer",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.20.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "1.21.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "1.22.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "1.22.0-1build1",
"evidence": "/affected/4/versions"
},
{
"value": "1.22.0-1build3",
"evidence": "/affected/4/versions"
},
{
"value": "1.22.0-1build4",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "pgbouncer",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.25.1-1",
"evidence": "/affected/5/versions"
},
{
"value": "1.25.2-1",
"evidence": "/affected/5/versions"
},
{
"value": "1.25.2-1ubuntu1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "pgbouncer",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.24.1-1",
"evidence": "/affected/6/versions"
},
{
"value": "1.25.0-2",
"evidence": "/affected/6/versions"
},
{
"value": "1.25.1-1",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-6669",
"aliases": [
"UBUNTU-CVE-2026-6669"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pgbouncer",
"purl": "pkg:deb/ubuntu/pgbouncer?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.5.5-1",
"1.6.1-1",
"1.7-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "pgbouncer",
"binary_version": "1.7-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pgbouncer",
"purl": "pkg:deb/ubuntu/pgbouncer?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.7.2-3build1",
"1.7.2-65-g2b8e6cf-1",
"1.8.1-1",
"1.8.1-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "pgbouncer",
"binary_version": "1.8.1-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pgbouncer",
"purl": "pkg:deb/ubuntu/pgbouncer?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.10.0-1",
"1.10.0-1build1",
"1.11.0-1",
"1.12.0-2",
"1.12.0-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "pgbouncer",
"binary_version": "1.12.0-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pgbouncer",
"purl": "pkg:deb/ubuntu/pgbouncer?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.15.0-1",
"1.16.1-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "pgbouncer",
"binary_version": "1.16.1-1ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pgbouncer",
"purl": "pkg:deb/ubuntu/pgbouncer?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.20.0-1",
"1.21.0-1",
"1.22.0-1",
"1.22.0-1build1",
"1.22.0-1build3",
"1.22.0-1build4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "pgbouncer",
"binary_version": "1.22.0-1build4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pgbouncer",
"purl": "pkg:deb/ubuntu/pgbouncer?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.25.1-1",
"1.25.2-1",
"1.25.2-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "pgbouncer",
"binary_version": "1.25.2-1ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pgbouncer",
"purl": "pkg:deb/ubuntu/pgbouncer?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.24.1-1",
"1.25.0-2",
"1.25.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "pgbouncer",
"binary_version": "1.25.1-1"
}
]
}
}
],
"modified": "2026-10-17T12:56:41.302735803Z",
"provider": "osv",
"upstream": [
"CVE-2026-6669"
],
"references": [
"https://ubuntu.com/security/CVE-2026-6669",
"https://www.cve.org/CVERecord?id=CVE-2026-6669",
"https://www.pgbouncer.org/changelog.html"
]
},
"related_cves": [
{
"value": "CVE-2026-6669",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 355955,
"published_at": "2026-09-23T17:17:00+00:00"
}