RHSA-2026:70698HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
September 23, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (3)

CVE-2026-6669 →CVE-2026-19888 →CVE-2026-6668 →

📋 Description

CVE-2026-6668 — pgbouncer: PgBouncer: Denial of Service via integer overflow in packet buffer growth CVE-2026-6669 — pgbouncer: PgBouncer: Denial of Service via unbounded SCRAM iteration count CVE-2026-19888 — pgbouncer: PgBouncer: Denial of Service via malformed SCRAM client-final-message

🎯 Affected products4

  • Red Hat Hardened Images
  • pgbouncer-0:1.26.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • pgbouncer-0:1.26.0-0.1.hum1@src as a component of Red Hat Hardened Images
  • pgbouncer-0:1.26.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, restrict network access to the PgBouncer service to only trusted clients or the local host. This can be achieved by configuring firewall rules to limit incoming connections to the PgBouncer port. Ensure that any changes to network configurations are applied and services are reloaded or restarted as necessary, which may temporarily disrupt existing connections. Workaround: To mitigate this issue, ensure that PgBouncer is configured to connect only to trusted and secured PostgreSQL backend servers. Restricting PgBouncer's access to untrusted or potentially compromised backends reduces the risk of a denial of service attack via unbounded SCRAM iteration counts. Workaround: To mitigate this issue, restrict network access to the PgBouncer service to only trusted clients or localhost. This can be achieved by configuring firewall rules to limit incoming connections to the PgBouncer port or by setting the `listen_addr` parameter in the `pgbouncer.ini` configuration file to `localhost` or specific trusted IP addresses. After modifying the `pgbouncer.ini` file, the PgBouncer service must be restarted for the changes to take effect, which will temporarily disrupt existing connections. Example for `pgbouncer.ini`: ``` [pgbouncer] listen_addr = 127.0.0.1 ``` Example for firewall (adjust port if necessary, default is 6432): ```bash firewall-cmd --permanent --zone=public --remove-port=6432/tcp firewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24 --add-port=6432/tcp firewall-cmd --reload ```

🔗 References (7)