EUVD-2026-89660
GHSA-8gw9-wqrc-j3gj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Pgpool-II port
-
DeliverySend crafted protocol message
-
ExploitOverflow stack buffer (CWE-121)
-
ExecutionAbnormal process termination
-
ImpactDatabase middleware outage (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special product configuration is named in the advisory: exploitation requires only network reachability to a Pgpool-II instance (versions in the affected 3.5.x through 4.7.2 ranges) and the ability to send a crafted message that triggers the stack overflow - unauthenticated (PR:N) and without user interaction (UI:N). The primary limiting factor is exposure: the attacker must be able to reach the Pgpool-II listening socket, so instances bound to internal/trusted networks or protected by firewalls/ACLs are far less at risk. The other key limit is impact scope - the confirmed outcome is a process crash (availability loss) affecting the Pgpool-II layer and the databases it fronts, with no demonstrated confidentiality or integrity compromise. |
| Impact | The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack, but the impact metrics are strictly availability-only (VC:N/VI:N/VA:H), so the vendor-assigned 8.7 reflects a pure denial-of-service - 'abnormal process termination' - not remote code execution. Although CWE-121 (stack-based buffer overflow) can theoretically enable RCE, both the description and the CVSS impact vector confine the confirmed effect to a crash, and no evidence of code execution is provided; treat any RCE potential as unverified. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the supplied data, so this is 'no public exploit identified at time of analysis' - a real, credible unauthenticated DoS priority for exposed Pgpool-II front-ends, but not evidence of active or automated exploitation. The 8.7 score is driven entirely by the ease of reaching the flaw (unauthenticated, network) against a single high-value impact dimension (availability), so patch prioritization should weigh whether the Pgpool-II listener is exposed to untrusted networks. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to the Pgpool-II listening port sends a crafted message that overflows a stack buffer during connection/protocol handling, causing the Pgpool-II process to terminate abnormally. Because Pgpool-II fronts PostgreSQL, crashing it severs the connection-pooling/load-balancing layer and disrupts database availability for all clients behind it. No public proof-of-concept is referenced, and the confirmed impact is a crash rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
Stack-based buffer overflow in Pgpool-II (versions 3.5.x through 4.7.2) allows unauthenticated remote attackers to crash the connection pooler process by sending a crafted message, causing a denial of service against Pgpool-II and the PostgreSQL databases it fronts. The vendor-assigned CVSS 4.0 score of 8.7 reflects strictly availability-only impact (VC:N/VI:N/VA:H), and no public exploit code has been identified at time of analysis. Exploitation requires only network reachability to the Pgpool-II listening socket; instances on internal or firewalled networks are at reduced risk.
Earlier versions of this analysis (1)
Unauthenticated remote attackers can crash a Pgpool-II instance by sending crafted input that overflows a stack-based buffer, causing abnormal termination of the affected process and disrupting the database connection-pooling layer (CWE-121). Affected releases span Pgpool-II 3.5.x through 4.2.x, 4.3.0-4.3.20, 4.4.0-4.4.17, 4.5.0-4.5.12, 4.6.0-4.6.7 and 4.7.0-4.7.2, as enumerated by the EUVD entry and reflected in the vendor CPE. The flaw scores CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with availability as the sole impacted metric, and no public exploit identified at time of analysis; exploitation requires network reachability to the listening port, and because Pgpool-II is normally deployed on internal segments between application servers and PostgreSQL backends, internet-facing exposure is uncommon and segmentation materially reduces risk.
RemediationAI
Apply the fix from the vendor advisory at https://pgpool.net/news/2026-09-29/ and the JVN advisory at https://jvn.jp/en/jp/JVN22475874/; patch availability is indicated by the vendor advisory, but an exact fixed version is not specified in the provided data, so confirm the recommended release on those pages before upgrading. If immediate patching is not possible, reduce exposure by restricting network access to the Pgpool-II listening socket using firewall rules or ACLs and binding the service only to internal or trusted interfaces, accepting that this may disrupt legitimate remote clients. Because the issue is an unauthenticated availability-only crash, authentication changes do not prevent triggering; instead, supplement with process supervision or automatic restart to shorten downtime from a crash, though this does not eliminate the underlying vulnerability. Monitor logs for abnormal process termination and repeated connection attempts as an indicator of exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pgpool-II is a middleware connection pooler, load balancer, and replication manager for PostgreSQL, typically deployed between application clients and database backends. The vulnerability is a stack-based buffer overflow (CWE-121) triggered when parsing a crafted message received on the Pgpool-II listening socket, where unbounded data is copied into a fixed-size stack buffer, corrupting control flow and causing abnormal process termination. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that the attack is remote, low-complexity, unauthenticated, and requires no user interaction, but both restrict impact to availability (VC:N/VI:N/VA:H), so the confirmed outcome is a crash rather than code execution. The CPE cpe:2.3:a:pgpool_global_development_group:pgpool-ii:*:*:*:*:*:*:*:* identifies all versions of the product in the affected namespace.
Know when Pgpool Ii gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated network attacker (PR:N, AV:N) with low complexity triggers a crash; impact is availability-only, so C:N/I:N/A:H and no scope change.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.
Executive ViewAI
A stack-based buffer overflow in Pgpool-II (versions 3.5.x through 4.7.2) allows a remote attacker with network reachability to the connection pooler's listening socket to crash the pooler process, which in turn disrupts the PostgreSQL databases it fronts. The impact is strictly availability-only, so affected organizations should plan for unplanned database outages and failed application connections rather than data theft or corruption. No vendor-released patch has been identified at time of analysis and no public exploit code identified at time of analysis, so risk is concentrated in deployments where the pooler port is reachable from untrusted networks.
No vendor-released patch identified at time of analysis; interim mitigations are network restriction of the Pgpool-II listening socket to trusted hosts, firewall or security-group allowlisting, disabling external exposure, rate limiting and monitoring of inbound pooler connections, inline filtering or IDS/IPS signatures to reject malformed messages, process supervision with auto-restart to shorten outage duration, and verified PostgreSQL failover/redundancy to limit business disruption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
NULL pointer dereference in Pgpool-II allows an unauthenticated remote attacker to crash the watchdog process when the h
An out-of-bounds write (CWE-787) in Pgpool-II, the PostgreSQL connection pooler, allows an authenticated attacker who al
An out-of-bounds write in the Pgpool-II connection pooling and load-balancing middleware allows an authenticated remote
Pgpool-II deployments that run in watchdog-based high-availability clustering mode can have an arbitrary watchdog node p
Client certificate authentication in Pgpool-II can be bypassed by a remote unauthenticated attacker because affected ver
Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0
Pgpool-II writes sensitive cluster configuration and topology information into its log files, allowing an authenticated
Exploit-DB