Is CVE-2026-19888 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-19888?

CVE-2026-19888 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-19888

Description

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.