CVE-2026-6665
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
May 09, 2026
Vendor
unknown
Description
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.