EUVD-2026-80831Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but reliably reaching an unrecovered internal goroutine panic is non-trivial and most paths appear admin/config-gated, so AC:H and PR:L; impact is availability-only (A:H), no C/I.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service. The remediation introduces routine.SafeWrap to convert recovered panics into regular errors and applies it to the affected internal worker functions. This issue is fixed in versions 0.22.48 and 0.39.7.
AnalysisAI
Denial of service in PocketBase versions prior to 0.22.48 (0.22.x branch) and 0.23.0 through 0.39.6 (0.23.0+ branch) allows an authenticated attacker or server misconfiguration to crash the process by triggering a panic in an internal goroutine that escapes the panic-recovery middleware. The flaw requires a network-reachable instance and low-privilege access (e.g., superuser) for the most directly reachable paths such as backup restore or view creation; public exploit code exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a network-reachable PocketBase instance prior to 0.22.48 (0.22.x line) or 0.39.7 (0.23.0-0.39.6 line). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are consistent that this is a genuine but availability-only issue, not a critical one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to PocketBase 0.22.48 (for the 0.22.x line) or 0.39.7 (for 0.23.0 and later) as released by the vendor (https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48, https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all PocketBase instances and confirm whether they run affected versions (0.22.x before 0.22.48, or 0.23.0 through 0.39.6); if internet-facing or business-critical, apply the vendor patch immediately, upgrading 0.22.x to 0.22.48 or later and 0.23.0+ to the next vendor-released fixed version after 0.39.6, then restart and verify process stability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Erugo file-sharing platform up to version 0.2.14 has a CVSS 10.0 path traversal allowing authenticated users to read any
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
WAGO PFC200 G2 PLC (firmware affected) allows privilege escalation through cookie manipulation. Users can modify cookie
Authentication bypass in WeGIA charitable institution management system before 3.6.5. The adicionar_tipo_docs_atendido.p
CGI path splitting vulnerability in FrankenPHP before 1.11.2 — Unicode characters bypass path validation during CGI proc
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Free5gc NRF 1.4.0 has an authorization bypass in access token generation that allows authenticated users to request toke
Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows
Stack-based buffer overflow in Tenda F453 firmware 1.0.0.3 allows remote attackers with valid credentials to achieve una
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today