AZL-103430
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103430.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-103430
- Upstream
- CVE-2026-19888
- Published
- 2026-09-23T17:17:14Z
- Modified
- 2026-09-24T14:16:29Z
- Summary
- CVE-2026-19888 affecting package pgbouncer 1.25.2-1
- Details
-
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
- References