EUVD-2026-89657
GHSA-2jc7-xqj7-hqmq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege credentials
-
DeliverySend crafted request to Pgpool-II
-
ExploitTrigger out-of-bounds write (CWE-787)
-
ExecutionCorrupt process memory
-
ImpactExecute arbitrary code or crash process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session against Pgpool-II (CVSS PR:L), meaning the attacker must first hold valid low-privileged credentials or a legitimate connection through the pooler; exploitation is then remote over the network (AV:N) with low complexity and no user interaction. The primary limiting factor is the authentication requirement - this is not an unauthenticated internet-facing flaw. Reliable arbitrary code execution (versus a process crash) is a further practical limiter, as OOB-write exploitation typically depends on memory layout and build specifics. Affected branches span Pgpool-II 3.5.x through 4.2.x and 4.3.0-4.3.20, 4.4.0-4.4.17, 4.5.0-4.5.12, 4.6.0-4.6.7, and 4.7.0-4.7.2; unaffected/patched releases are outside these ranges. |
| Impact | This is a genuine high-priority issue, not merely a high-CVSS-but-low-risk artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact on the vulnerable system (no scope change). CWE-787 (out-of-bounds write) combined with the description's explicit 'arbitrary code execution' possibility makes this materially more severe than the availability-only DoS in its sibling CVE-2026-92869, where impact was VA:H only. No EPSS score, KEV listing, POC, or SSVC decision data is provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - the elevated risk here derives from the intrinsic RCE potential and network reach, not from observed exploitation. The one caveat worth verifying: OOB-write bugs often only achieve reliable arbitrary code execution under specific memory conditions, and the vendor phrasing 'may allow... or arbitrary code execution' signals that RCE is potential rather than demonstrated; abnormal process termination (DoS) is the more certain outcome. The PR:L requirement (a valid, low-privileged authenticated database/pool session) is the main real-world limiter. |
| Exploit ScenarioDerived | An attacker with valid low-privileged authenticated access to a Pgpool-II instance sends a specially crafted request/payload that triggers an out-of-bounds write in a Pgpool-II process. This corrupts memory to crash the pooling process (denial of service) or, under favorable conditions, to execute arbitrary code with the privileges of the Pgpool-II service. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
An out-of-bounds write (CWE-787) in Pgpool-II, the PostgreSQL connection pooler, allows an authenticated attacker who already holds valid low-privileged credentials to cause abnormal termination of the Pgpool-II process or, depending on memory layout and build hardening, to achieve arbitrary code execution. Affected branches span 3.5.x through 4.2.x as well as 4.3.0-4.3.20, 4.4.0-4.4.17, 4.5.0-4.5.12, 4.6.0-4.6.7 and 4.7.0-4.7.2; exploitation is remote (AV:N), low complexity and requires no user interaction, but the PR:L authentication prerequisite makes this a post-authentication flaw rather than an unauthenticated internet-facing one. The vendor score is 8.7 (CVSS 4.0) and the independent assessment maps it to 8.8 (CVSS 3.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis and there is no CISA KEV listing confirming active exploitation.
Earlier versions of this analysis (1)
An out-of-bounds write in Pgpool-II's protocol message-handling code lets an authenticated attacker who can reach the pooler over the network crash the process or potentially achieve arbitrary code execution, consistent with the vendor score of 8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and our independent 3.1 assessment of the same metrics. Affected deployments are those running the 3.5.x through 4.2.x branches, or 4.3.0-4.3.20, 4.4.0-4.4.17, 4.5.0-4.5.12, 4.6.0-4.6.7, and 4.7.0-4.7.2. Exploitation requires valid credentials (PR:L), so the practical exposure is concentrated in multi-tenant or broadly reachable pooler deployments; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: fixes are described in the Pgpool-II announcement at https://pgpool.net/news/2026-09-29/ and the JVN advisory JVN22475874 (https://jvn.jp/en/jp/JVN22475874/), and per the independent assessment the corrected releases lie outside the vulnerable ranges (3.5.x-4.2.x, and above 4.3.20, 4.4.17, 4.5.12, 4.6.7 and 4.7.2 respectively), so the primary action is to upgrade every affected branch to the current fixed release published for that branch and then verify the deployed version; no exact fix version numbers were supplied in the source data, so confirm the specific release identifier on the vendor advisory before scheduling the change. Because exploitation requires an authenticated low-privileged session against the pooler, high-value compensating controls are to restrict network access to the Pgpool-II listener so that only trusted application hosts and administrative networks can reach it (trade-off: adds a firewall/proxy hop and complicates legitimate client onboarding), to enforce strong per-user credentials and avoid shared or pooled application accounts so that a single compromised credential does not grant a foothold on the pooler (trade-off: more credential-management overhead), to run the Pgpool-II process under a dedicated unprivileged account with minimal filesystem and network rights so that post-exploitation code execution does not yield host-level control (trade-off: may require reworking configuration and log paths), and to keep ASLR and other memory-hardening features enabled to reduce the reliability of converting the out-of-bounds write into code execution, while monitoring the pooler for abnormal process termination as an indicator of attempted exploitation. Note that none of these workarounds removes the memory-corruption flaw; they only reduce exposure and attack reliability until the fixed release is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pgpool-II is a middleware connection pooler that sits between PostgreSQL clients and one or more backend database servers, terminating client connections, handling authentication and forwarding PostgreSQL wire-protocol messages, query text and results. The flaw is an out-of-bounds write (CWE-787): improper validation of a length or index derived from attacker-influenced input causes data to be written past the end of an allocated buffer, corrupting adjacent heap or stack memory. The immediate, highly reliable consequence is memory corruption leading to abnormal process termination (denial of service against the pooler and, transitively, the application connections it fronts), while the assessed CVSS 3.1 impact metrics (C:H/I:H/A:H, S:U) reflect that a controlled corruption can additionally subvert confidentiality and integrity within the pooler's security scope - significant because the pooler handles database credentials, session state and query traffic. The CVSS 4.0 vector supplied by the vendor (AV:N/AC:L/AT:N/PR:L/UI:N/E:X) and the independent CVSS 3.1 vector agree that network reachability with low complexity is required, but that a low-privileged authenticated position is a prerequisite (PR:L); reliable arbitrary code execution, as opposed to a crash, is a further practical limiter because OOB-write exploitation depends on allocator behaviour, memory layout, compiler and mitigation settings such as ASLR. CPE data identifies the affected package as cpe:2.3:a:pgpool_global_development_group:pgpool-ii with an unspecified version, consistent with the multi-branch version coverage reported by EUVD (EUVD-2026-89657) and JPCERT.
Know when Pgpool Ii gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable and low-complexity with a required low-privileged authenticated session (PR:L); OOB write enabling potential code execution yields high C/I/A, no scope change (S:U).
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.
Executive ViewAI
Pgpool-II, a critical PostgreSQL connection pooler, has a high-severity vulnerability (CVE-2026-92867) that an authenticated attacker with low-privileged credentials could exploit to crash the pooler or potentially execute arbitrary code. Because Pgpool-II often serves as central middleware for database high availability and load balancing, successful exploitation could disrupt application connectivity, leading to business service outages and potential data compromise. With no vendor-released patch identified at time of analysis, leadership should ensure interim mitigations are prioritized to protect database-dependent operations.
Restrict network access to Pgpool-II to trusted hosts, enforce strong authentication and least privilege for database users, monitor for abnormal process terminations, and consider network segmentation or alternative connection poolers until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
NULL pointer dereference in Pgpool-II allows an unauthenticated remote attacker to crash the watchdog process when the h
Stack-based buffer overflow in Pgpool-II (versions 3.5.x through 4.7.2) allows unauthenticated remote attackers to crash
An out-of-bounds write in the Pgpool-II connection pooling and load-balancing middleware allows an authenticated remote
Pgpool-II deployments that run in watchdog-based high-availability clustering mode can have an arbitrary watchdog node p
Client certificate authentication in Pgpool-II can be bypassed by a remote unauthenticated attacker because affected ver
Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0
Pgpool-II writes sensitive cluster configuration and topology information into its log files, allowing an authenticated
Exploit-DB