CVE-2026-19888

Summary

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.

Affected Software

VendorProductVersion RangeStatus
n/aPgBouncer0 <= 1.25.2affected

Weaknesses

  • CWE-476: NULL Pointer Dereference

Workarounds

Restrict network access to the PgBouncer listener to trusted clients. No configuration change avoids the issue for deployments that must accept SCRAM authentication from untrusted networks, because the crash occurs before any credential is verified and PgBouncer performs a mock SCRAM exchange even for users that do not exist.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References