Bug 2539548 (CVE-2026-6668)

Summary: CVE-2026-6668 pgbouncer: PgBouncer: Denial of Service via integer overflow in packet buffer growth
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in PgBouncer. An unauthenticated remote attacker can exploit an integer overflow in the packet buffer growth logic by providing sufficiently large input. This causes the buffer size computation to overflow, leading to an infinite loop. As a result, a CPU core is saturated, and all pooled connections are stalled, causing a Denial of Service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2539632, 2539633    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-23 17:03:30 UTC 
Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is killed. Both unauthenticated and authenticated code paths can reach the overflow.