PG
Product
PgBouncer
11
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 1High 7Medium 3Low 0
Watch
Add PgBouncer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-6665 | 9.8 | May 9 | PgBouncer buffer overflow in SCRAM Affected: before 1.25.2 |
| CVE-2026-107350 | 8.8 | Oct 14 | Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer Affected: 1.17.0 before 1.26.1 |
| CVE-2025-12819 | 8.1 | Dec 3 | Untrusted search path in auth_query connection in PgBouncer Affected: before 1.25.1 |
| CVE-2026-107349 | 7.5 | Oct 14 | Infinite loop on empty option name in startup options parameter in PgBouncer Affected: 1.20.0 before 1.26.1 |
| CVE-2026-19888 | 7.5 | Sep 23 | NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer Affected: through 1.25.2 |
| CVE-2026-6668 | 7.5 | Sep 23 | Integer overflow causes an infinite loop in packet buffer growth in PgBouncer Affected: through 1.25.2 |
| CVE-2026-6666 | 7.5 | May 9 | PgBouncer crash in kill_pool_logins_server_error Affected: before 1.25.2 |
| CVE-2026-6664 | 7.5 | May 9 | PgBouncer integer overflow in PgBouncer network packet parsing Affected: before 1.25.2 |
| CVE-2026-107348 | 5.9 | Oct 14 | Integer overflow causes an infinite loop in message buffer growth in PgBouncer Affected: 1.21.0 before 1.26.1 |
| CVE-2026-6669 | 5.9 | Sep 23 | Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer Affected: through 1.25.2 |
| CVE-2026-6667 | 4.3 | May 9 | PgBouncer missing authorization check in KILL_CLIENT admin command Affected: before 1.25.2 |
Showing 11