CVE-2026-19888 NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
An unauthenticated remote attacker can crash the PgBouncer process via a malformed SCRAM message, terminating all pooled connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19888?
CVE-2026-19888 is a high-severity vulnerability in PgBouncer, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
Weakness: CWE-476
Which versions are affected by CVE-2026-19888?
1 open source package ship an affected version, including pgbouncer.
| Package | Affected | Fixed in |
|---|---|---|
pgbouncer Bitnami | All versions | 1.26.0 |
How do I fix CVE-2026-19888?
Upgrade pgbouncer to 1.26.0 or later.
Is CVE-2026-19888 being exploited?
There is no known exploitation of CVE-2026-19888 in the wild and no public exploit code.
Sources
Also known as AZL-103430, BIT-pgbouncer-2026-19888, DEBIAN-CVE-2026-19888, ECHO-0734-af85-f434, GHSA-w79m-39mq-x36c, MINI-v9j2-37r9-f7g3 and 1 more.