NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
Summary
| CVE | CVE-2026-19888 |
|---|---|
| State | PUBLISHED |
| Assigner | PostgreSQL |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-23 17:17:14 UTC |
| Updated | 2026-09-23 19:40:10 UTC |
| Description | Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.003920000 probability, percentile 0.304900000 (date 2026-09-24)
Problem Types: CWE-476 | CWE-476 NULL Pointer Dereference
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.pgbouncer.org/changelog.html | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | www.pgbouncer.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Thanks to @mble for finding and reporting this issue. (en)
CNA: Independently reported by @thesecguy45. (en)
CNA: Independently reported by @umutbasal. (en)
CNA: Independently reported by @jackds-security. (en)
CNA: Independently reported by @palak-paneer. (en)
CNA: Independently reported by @shakirov-vm. (en)
Additional Advisory Data
Workarounds
CNA: Restrict network access to the PgBouncer listener to trusted clients. No configuration change avoids the issue for deployments that must accept SCRAM authentication from untrusted networks, because the crash occurs before any credential is verified and PgBouncer performs a mock SCRAM exchange even for users that do not exist.