Provenance Record

Strong 829-word Briefing on a Postgres-tier infrastructure CVE set. Per-CVE breakdown with CVSS / CWE / vector / discoverer attribution. Distribution-status section grounded in the live Debian Security Tracker page. Tone neutral and technical, appropriate for an ops audience.

Read all 7 snapshots. source-0 PgBouncer changelog (68k chars): all four CVE descriptions verbatim — 'An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check', 'a SCRAM server-final-message with a long nonce can trigger a stack overflow', 'did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message', 'A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field', 'did not perform an appropriate authorization check for the KILL_CLIENT admin command', 'admin_users parameter'. Also confirmed: 1.25.0 'The one with LDAP support' Nov 9 2025, client_tls13_ciphers / server_tls13_ciphers options. source-1 NVD (4.4k chars): CVE-2026-6664 = 7.5 HIGH, CWE-190 verbatim. source-2 CIRCL (17k chars): CVE-2026-6665 = 8.1 HIGH, CWE-121, HarutoKimura, strlcat all verbatim. source-3 ThreatInt CVE-6666 (885 chars): 5.9, HarutoKimura. source-4 ThreatInt CVE-6667 (1k chars): 4.3, HarutoKimura, KILL_CLIENT, admin_users. source-5 ThreatInt CVE-6664 (992 chars): 7.5, Johannes Möller. source-6 Debian Security Tracker (1.3k chars): bookworm 1.18.0-1+deb12u1 vulnerable, trixie 1.24.1-1+deb13u1 vulnerable, forky 1.25.1-1 vulnerable, sid 1.25.2-1 patched, no-dsa tag for bookworm + trixie all verbatim.

All four CVE IDs, CVSS scores, CWE classifications, version-status table entries, and credit attributions verified. No fabrications.

APPROVE. Tight, technically accurate CVE breakdown with every claim sourced and verified. No corrections record needed.