PatchTheCVEpgbouncer vulnerabilities and fixes
Recent CVEs affecting pgbouncer, with upgrade or downgrade steps. 4 tracked.
pgbouncer has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-05-09. Highest priority: CVE-2026-6664 (score 44/100).
- CVE-2026-6664 HIGH 7.5 UPGRADE An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and ca
- CVE-2026-6665 HIGH 8.1 UPGRADE The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building
- CVE-2026-6666 MEDIUM 5.9 UPGRADE A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error
- CVE-2026-6667 MEDIUM 4.3 UPGRADE PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command
FAQ
How do I fix pgbouncer vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pgbouncer being exploited right now?
None of the tracked pgbouncer CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pgbouncer CVE should I patch first?
CVE-2026-6664 currently ranks highest (44/100): An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and ca.