{"api_version":"1","generated_at":"2026-10-01T16:18:29+00:00","cve":"CVE-2026-19888","urls":{"html":"https://cve.report/CVE-2026-19888","api":"https://cve.report/api/cve/CVE-2026-19888.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-19888","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-19888"},"summary":{"title":"NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer","description":"Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.","state":"PUBLISHED","assigner":"PostgreSQL","published_at":"2026-09-23 17:17:14","updated_at":"2026-09-23 19:40:10"},"problem_types":["CWE-476","CWE-476 NULL Pointer Dereference"],"metrics":[{"version":"3.1","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://www.pgbouncer.org/changelog.html","name":"https://www.pgbouncer.org/changelog.html","refsource":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19888","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19888","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"PgBouncer","version":"affected 1.25.2 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Restrict network access to the PgBouncer listener to trusted clients. No configuration change avoids the issue for deployments that must accept SCRAM authentication from untrusted networks, because the crash occurs before any credential is verified and PgBouncer performs a mock SCRAM exchange even for users that do not exist.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Thanks to @mble for finding and reporting this issue.","lang":"en"},{"source":"CNA","value":"Independently reported by @thesecguy45.","lang":"en"},{"source":"CNA","value":"Independently reported by @umutbasal.","lang":"en"},{"source":"CNA","value":"Independently reported by @jackds-security.","lang":"en"},{"source":"CNA","value":"Independently reported by @palak-paneer.","lang":"en"},{"source":"CNA","value":"Independently reported by @shakirov-vm.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"19888","cve":"CVE-2026-19888","epss":"0.003920000","percentile":"0.304900000","score_date":"2026-09-24","updated_at":"2026-09-25 00:02:55"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-19888","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-23T16:33:38.167752Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-23T16:46:13.585Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"PgBouncer","vendor":"n/a","versions":[{"lessThanOrEqual":"1.25.2","status":"affected","version":"0","versionType":"semver"}]}],"configurations":[{"lang":"en","value":"auth_type is set to scram-sha-256 (non-default configuration), or auth_type is set to md5 (default configuration) and a user has a SCRAM secret stored, which causes PgBouncer to upgrade that login to SCRAM"}],"credits":[{"lang":"en","type":"finder","value":"Thanks to @mble for finding and reporting this issue."},{"lang":"en","type":"finder","value":"Independently reported by @thesecguy45."},{"lang":"en","type":"finder","value":"Independently reported by @umutbasal."},{"lang":"en","type":"finder","value":"Independently reported by @jackds-security."},{"lang":"en","type":"finder","value":"Independently reported by @palak-paneer."},{"lang":"en","type":"finder","value":"Independently reported by @shakirov-vm."}],"descriptions":[{"lang":"en","value":"Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","description":"NULL Pointer Dereference","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-23T16:04:48.392Z","orgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","shortName":"PostgreSQL"},"references":[{"url":"https://www.pgbouncer.org/changelog.html"}],"title":"NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer","workarounds":[{"lang":"en","value":"Restrict network access to the PgBouncer listener to trusted clients. No configuration change avoids the issue for deployments that must accept SCRAM authentication from untrusted networks, because the crash occurs before any credential is verified and PgBouncer performs a mock SCRAM exchange even for users that do not exist."}]}},"cveMetadata":{"assignerOrgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","assignerShortName":"PostgreSQL","cveId":"CVE-2026-19888","datePublished":"2026-09-23T16:04:48.392Z","dateReserved":"2026-08-14T16:55:37.365Z","dateUpdated":"2026-09-23T16:46:13.585Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-23 17:17:14","lastModifiedDate":"2026-09-23 19:40:10","problem_types":["CWE-476","CWE-476 NULL Pointer Dereference"],"metrics":{"cvssMetricV31":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:33:38.167752Z","id":"CVE-2026-19888","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"19888","Ordinal":"1","Title":"NULL pointer dereference in SCRAM client-final-message parsing i","CVE":"CVE-2026-19888","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"19888","Ordinal":"1","NoteData":"Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.","Type":"Description","Title":"NULL pointer dereference in SCRAM client-final-message parsing i"}]}}}