CVE-2026-6666 PgBouncer crash in kill_pool_logins_server_error

Medium 5.9 Published 9 May 2026 Updated 11 May 2026

A null pointer dereference in PgBouncer allows a malicious server to cause a crash by sending an error response without an SQLSTATE field.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-6666?

CVE-2026-6666 is a medium-severity vulnerability in PgBouncer, published on 9 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.

Weakness: CWE-476

Which versions are affected by CVE-2026-6666?

1 open source package ship an affected version, including pgbouncer. It affects 1 product.

Package	Affected	Fixed in
`pgbouncer` Bitnami	All versions	`1.25.2`

Products include Pgbouncer Pgbouncer.

How do I fix CVE-2026-6666?

Upgrade pgbouncer to 1.25.2 or later.

Is CVE-2026-6666 being exploited?

There is no known exploitation of CVE-2026-6666 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as AZL-86243, BIT-pgbouncer-2026-6666, CLEANSTART-2026-XI13738, DEBIAN-CVE-2026-6666, GHSA-4463-8rvf-rj9f, MINI-2j8r-xv56-5cv2 and 1 more.