nicolasjulian/bouncer-overflowWorking POC of CVE-2026-6664 written by Sonnet 4.6
This repository contains a local proof of concept for a PgBouncer crash caused
by an integer overflow in vulnerable PgBouncer versions. The included Docker
setup builds PgBouncer 1.25.1, starts a PostgreSQL backend, enables
SCRAM-SHA-256 authentication, and runs poc.py against PgBouncer.
This is intended for controlled lab testing only. Do not run this against systems you do not own or have explicit permission to test.
poc.py - Python proof-of-concept client.docker-compose.yml - Local PostgreSQL, PgBouncer, and PoC runner services.postgres/init.sql - Creates the test database user.pgbouncer/Dockerfile - Builds vulnerable PgBouncer 1.25.1.pgbouncer/pgbouncer.ini - PgBouncer configuration using SCRAM auth.pgbouncer/gen_userlist.py - Generates a deterministic SCRAM verifier.poc.py manually from the hostBuild and start the lab:
docker compose up --build
The compose file starts:
6432.To run only the services and execute the PoC manually:
docker compose up --build postgres pgbouncer
python3 poc.py 127.0.0.1 6432
When the vulnerable PgBouncer process hits the malformed SASL initial response, the client should report a reset connection or PgBouncer becoming unreachable. The PoC checks for this condition and prints whether the crash was confirmed.
Stop and remove the lab containers:
docker compose down
The PoC defaults to:
127.0.0.16432testusertestdbCustom target:
python3 poc.py <host> <port>