Skip to content
OpenAdvisories
High RHSA-2026:70698 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 25, 2026 · Updated Sep 25, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 pgbouncer 0:1.26.0-0.1.hum1

Vulnerabilities 3

  • High 7.5
    CVE-2026-19888

    NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer

    Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required va…

    pgbouncer pgbouncer pgbouncer Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-6668

    Integer overflow causes an infinite loop in packet buffer growth in PgBouncer

    Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to termi…

    pgbouncer pgbouncer pgbouncer Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2026-6669

    Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer

    Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulti…

    pgbouncer pgbouncer pgbouncer Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-6668
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-6669
  • report
    https://access.redhat.com/security/cve/CVE-2026-19888
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70698.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539548
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6668
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6668
  • article
    https://www.pgbouncer.org/changelog.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539546
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6669
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6669
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539545
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19888
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19888