Warning: Actively exploited Integer Overflow in PgBouncer, Patch Immediately!

• Last update: 20/05/2026
• Affected software: PgBouncer versions before 1.25.2
• Type: CWE-190: Integer Overflow or Wraparound
• CVE/CVSS: CVE-2026-6664: CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Sources

https://www.pgbouncer.org/changelog.html#pgbouncer-125x

Risks

PgBouncer is an open-source connection pooler for PostgreSQL, available free of charge.
In early May 2026, a vulnerability affecting PgBouncer was discovered, which affects all versions prior to 1.25.2.There is a publicly available proof of concept on github and there are reports of exploitation.
If an attacker exploits CVE-2026-6664, that could have a high impact on the availability of the affected system, but no impact on its confidentiality or integrity.

Description

CVE-2026-6664 is a vulnerability that remote attackers without prior authentication, nor any user interaction, can exploit to cause a system crash via bypassing boundary checks. They can accomplish that by crafting a custom SCRAM authentication packet with improper form.
This vulnerability stems from an integer overflow in the code section that processes network packages.

Recommended Actions

Patch

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority, after thorough testing.

Monitor/Detect

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity, ensuring a swift response in case of an intrusion.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-6664
https://exploit-intel.com/vuln/CVE-2026-6664
https://github.com/nicolasjulian/bouncer-overflow