CVE-2026-6666

概要

参考情報

• pgbouncer.org/changelog.html · Release Notes

pgbouncer のその他の脆弱性

• CVE-2026-6667中 4.3PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the a…
• CVE-2026-6665緊急 9.8The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM clie…
• CVE-2026-6664高 7.5An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthen…
• CVE-2025-12819高 8.1Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQ…
• CVE-2025-2291緊急 9.8Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an atta…