https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 19:54:28 +0000 https://vulnerability.circl.lu/vuln/bdu:2026-15219 bdu:2026-15219 https://vulnerability.circl.lu/vuln/bdu:2026-15219 https://vulnerability.circl.lu/vuln/fkie_cve-2026-19888 <p>Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.</p> <p>Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-19888 https://vulnerability.circl.lu/vuln/ghsa-w79m-39mq-x36c <p>Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.</p> <p>Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.</p> https://vulnerability.circl.lu/vuln/ghsa-w79m-39mq-x36c https://vulnerability.circl.lu/vuln/msrc_cve-2026-19888 msrc_CVE-2026-19888 https://vulnerability.circl.lu/vuln/msrc_cve-2026-19888 https://vulnerability.circl.lu/vuln/rhsa-2026:70698 <p>pgbouncer: PgBouncer: Denial of Service via integer overflow in packet buffer growth pgbouncer: PgBouncer: Denial of Service via unbounded SCRAM iteration count pgbouncer: PgBouncer: Denial of Service via malformed SCRAM client-final-message</p> <p>pgbouncer: PgBouncer: Denial of Service via integer overflow in packet buffer growth pgbouncer: PgBouncer: Denial of Service via unbounded SCRAM iteration count pgbouncer: PgBouncer: Denial of Service via malformed SCRAM client-final-message</p> https://vulnerability.circl.lu/vuln/rhsa-2026:70698 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-19888 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: pgbouncer, Ubuntu:18.04:LTS: pgbouncer, Ubuntu:20.04:LTS: pgbouncer, Ubuntu:22.04:LTS: pgbouncer, Ubuntu:24.04:LTS: pgbouncer, Ubuntu:26.04:LTS: pgbouncer</p> <p>Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: pgbouncer, Ubuntu:18.04:LTS: pgbouncer, Ubuntu:20.04:LTS: pgbouncer, Ubuntu:22.04:LTS: pgbouncer, Ubuntu:24.04:LTS: pgbouncer, Ubuntu:26.04:LTS: pgbouncer</p> <p>Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-19888