Поиск уязвимостей
Количество 9
Количество 9
GHSA-w79m-39mq-x36c
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
CVE-2026-19888
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
CVE-2026-19888
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
CVE-2026-19888
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
CVE-2026-19888
NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
CVE-2026-19888
Missing validation of a mandatory attribute in the SCRAM client-final- ...
BDU:2026-15219
Уязвимость механизма SCRAM (Salted Challenge Response Authentication Mechanism) программного обеспечения для пула соединения в PostgreSQL PgBouncer, позволяющая нарушителю вызвать отказ в обслуживании
ALT-PU-2026-16528
ALT-PU-2026-16528: package `pgbouncer` update to version 1.26.0-alt1
ALT-PU-2026-16294
ALT-PU-2026-16294: package `pgbouncer` update to version 1.26.0-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-w79m-39mq-x36c Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection. | CVSS3: 7.5 | 0% Низкий | около 2 месяцев назад |
 | CVE-2026-19888 Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection. | CVSS3: 7.5 | 0% Низкий | около 2 месяцев назад |
 | CVE-2026-19888 Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection. | CVSS3: 7.5 | 0% Низкий | около 2 месяцев назад |
 | CVE-2026-19888 Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection. | CVSS3: 7.5 | 0% Низкий | около 2 месяцев назад |
 | CVE-2026-19888 NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer | CVSS3: 7.5 | 0% Низкий | около 1 месяца назад |
| CVE-2026-19888 Missing validation of a mandatory attribute in the SCRAM client-final- ... | CVSS3: 7.5 | 0% Низкий | около 2 месяцев назад |
 | BDU:2026-15219 Уязвимость механизма SCRAM (Salted Challenge Response Authentication Mechanism) программного обеспечения для пула соединения в PostgreSQL PgBouncer, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 7.5 | 0% Низкий | около 2 месяцев назад |
| ALT-PU-2026-16528 ALT-PU-2026-16528: package `pgbouncer` update to version 1.26.0-alt1 | CVSS3: 7.5 | около 1 месяца назад | |
| ALT-PU-2026-16294 ALT-PU-2026-16294: package `pgbouncer` update to version 1.26.0-alt1 | CVSS3: 7.5 | около 1 месяца назад |
Уязвимостей на страницу