{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19888", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-08-14T16:55:37.365Z", "datePublished": "2026-09-23T16:04:48.392Z", "dateUpdated": "2026-09-23T16:46:13.585Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-09-23T16:04:48.392Z"}, "title": "NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer", "descriptions": [{"lang": "en", "value": "Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection."}], "affected": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"version": "0", "lessThanOrEqual": "1.25.2", "versionType": "semver", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-476", "type": "CWE", "description": "NULL Pointer Dereference"}]}], "references": [{"url": "https://www.pgbouncer.org/changelog.html"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "auth_type is set to scram-sha-256 (non-default configuration), or auth_type is set to md5 (default configuration) and a user has a SCRAM secret stored, which causes PgBouncer to upgrade that login to SCRAM"}], "workarounds": [{"lang": "en", "value": "Restrict network access to the PgBouncer listener to trusted clients. No configuration change avoids the issue for deployments that must accept SCRAM authentication from untrusted networks, because the crash occurs before any credential is verified and PgBouncer performs a mock SCRAM exchange even for users that do not exist."}], "credits": [{"lang": "en", "value": "Thanks to @mble for finding and reporting this issue.", "type": "finder"}, {"lang": "en", "value": "Independently reported by @thesecguy45.", "type": "finder"}, {"lang": "en", "value": "Independently reported by @umutbasal.", "type": "finder"}, {"lang": "en", "value": "Independently reported by @jackds-security.", "type": "finder"}, {"lang": "en", "value": "Independently reported by @palak-paneer.", "type": "finder"}, {"lang": "en", "value": "Independently reported by @shakirov-vm.", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19888", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T16:33:38.167752Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T16:46:13.585Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19888", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T16:33:38.167752Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T16:36:44.516Z"}}], "cna": {"title": "NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer", "credits": [{"lang": "en", "type": "finder", "value": "Thanks to @mble for finding and reporting this issue."}, {"lang": "en", "type": "finder", "value": "Independently reported by @thesecguy45."}, {"lang": "en", "type": "finder", "value": "Independently reported by @umutbasal."}, {"lang": "en", "type": "finder", "value": "Independently reported by @jackds-security."}, {"lang": "en", "type": "finder", "value": "Independently reported by @palak-paneer."}, {"lang": "en", "type": "finder", "value": "Independently reported by @shakirov-vm."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "n/a", "product": "PgBouncer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.25.2"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.pgbouncer.org/changelog.html"}], "workarounds": [{"lang": "en", "value": "Restrict network access to the PgBouncer listener to trusted clients. No configuration change avoids the issue for deployments that must accept SCRAM authentication from untrusted networks, because the crash occurs before any credential is verified and PgBouncer performs a mock SCRAM exchange even for users that do not exist."}], "descriptions": [{"lang": "en", "value": "Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "NULL Pointer Dereference"}]}], "configurations": [{"lang": "en", "value": "auth_type is set to scram-sha-256 (non-default configuration), or auth_type is set to md5 (default configuration) and a user has a SCRAM secret stored, which causes PgBouncer to upgrade that login to SCRAM"}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-09-23T16:04:48.392Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19888", "state": "PUBLISHED", "dateUpdated": "2026-09-23T16:46:13.585Z", "dateReserved": "2026-08-14T16:55:37.365Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-09-23T16:04:48.392Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"lessThanOrEqual": "1.25.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection."}], "id": "CVE-2026-19888", "lastModified": "2026-09-23T17:17:14.917", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19888", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-23T16:33:38.167752Z", "version": "2.0.3"}}]}, "published": "2026-09-23T17:17:14.917", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.pgbouncer.org/changelog.html"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.25.2]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PgBouncer", "source": "cna", "vendor": "n/a"}, "product": "pgbouncer", "vendor": "pgbouncer"}], "created": "2026-09-23T17:45:07.975800+00:00", "updated": "2026-09-23T18:30:06.735969+00:00", "vendors": ["pgbouncer", "pgbouncer$PRODUCT$pgbouncer"]}