EUVD-2026-89675
GHSA-98gg-48ph-mg6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach watchdog network port unauthenticated
-
ExploitSend crafted request triggering NULL deref
-
ExecutionWatchdog process abnormally terminates
-
ImpactHA coordination/failover disrupted (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Pgpool-II watchdog feature be enabled and network-reachable - this is the high-availability/failover clustering component, not active in single-node or non-HA deployments, which is the primary limiting factor. Where watchdog is configured, the CVSS vector (PR:N/UI:N/AC:L/AT:N) indicates no authentication, no user interaction, and no special attack conditions are needed against a reachable watchdog endpoint. Impact is confined to abnormal termination of the watchdog process (availability); there is no confidentiality or integrity effect, and no privilege escalation. |
| Impact | This is a real but availability-only risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) describes a remote, unauthenticated, low-complexity attack with no attack requirements, impacting only availability (VA:H) - confidentiality and integrity are untouched, consistent with a NULL pointer dereference that crashes rather than corrupts. The 8.7 score reflects CVSS 4.0's heavier weighting of clean unauth-remote availability loss; the practical impact is a denial of service against the watchdog process only, not data exposure or code execution. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (network vector matches an unauthenticated crash of a network-facing HA component), so this reads as a genuine but bounded DoS priority rather than an inflated high-CVSS issue - its real-world severity hinges on whether the watchdog (HA clustering) feature is actually deployed, which most standalone Pgpool-II installs do not use. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to a Pgpool-II node running the watchdog sends crafted input that reaches an unchecked code path, dereferencing a NULL pointer and abnormally terminating the watchdog process. This degrades or disrupts high-availability coordination and failover for the PostgreSQL cluster front-ended by Pgpool-II. No public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
NULL pointer dereference in Pgpool-II allows an unauthenticated remote attacker to crash the watchdog process when the high-availability clustering feature is enabled and network-reachable. This is an availability-only impact (no confidentiality or integrity loss) and is limited to HA deployments where watchdog is configured; single-node or non-HA installations are unaffected. No public exploit identified at time of analysis, and the vendor has not yet released a patch.
Earlier versions of this analysis (1)
Unauthenticated network attackers can force abnormal termination of the Pgpool-II watchdog process, causing denial of service in high-availability clusters that have watchdog mode enabled (CVE-2026-92871). The flaw is a remote, low-complexity NULL pointer dereference (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact) confined to the HA coordination layer - single-node or non-clustered Pgpool-II installations never start the watchdog process and are therefore not exposed, and the PostgreSQL data path is not directly affected. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but watchdog loss can destabilise failover behaviour, so clustered operators should prioritise remediation.
RemediationAI
No vendor-released patch identified at time of analysis; monitor https://pgpool.net/news/2026-09-29/ and https://jvn.jp/en/jp/JVN22475874/ for an update. As a compensating control, restrict network access to the watchdog communication port (e.g., via firewall rules) so that only trusted Pgpool-II nodes can reach it-this preserves HA functionality but may require careful network segmentation. If watchdog is not needed, disabling it eliminates the attack surface entirely, but this removes high-availability failover capability. Avoid exposing the watchdog port to untrusted networks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-476 NULL pointer dereference in Pgpool-II's watchdog component, which handles cluster coordination, failover, and heartbeat messaging between Pgpool-II nodes. The wildcard CPE cpe:2.3:a:pgpool_global_development_group:pgpool-ii:*:*:*:*:*:*:*:* indicates all versions of Pgpool-II are potentially affected, though the watchdog feature must be enabled and reachable over the network. An attacker can send crafted traffic to the watchdog communication endpoint, triggering a NULL dereference that terminates the watchdog process, disrupting cluster management. The flaw does not lead to code execution, privilege escalation, or data exposure.
Know when Pgpool Ii gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated remote crash of the watchdog process with no interaction or complexity gives AV:N/AC:L/PR:N/UI:N; availability-only impact yields A:H with C:N/I:N and no scope change.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.
Executive ViewAI
Pgpool-II high-availability deployments using the watchdog feature face a remotely triggerable crash that can disrupt database failover and availability. Because the issue affects only HA clusters and no vendor patch is available, leadership should treat this as an operational continuity risk for teams relying on Pgpool-II for uptime. No public exploit identified at time of analysis, but unpatched exposure warrants prioritized network and configuration mitigations.
Restrict network access to Pgpool-II watchdog communications to trusted cluster nodes only; disable watchdog/HA clustering if not operationally required; monitor for unexpected watchdog process termination and failover events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in Pgpool-II (versions 3.5.x through 4.7.2) allows unauthenticated remote attackers to crash
An out-of-bounds write (CWE-787) in Pgpool-II, the PostgreSQL connection pooler, allows an authenticated attacker who al
An out-of-bounds write in the Pgpool-II connection pooling and load-balancing middleware allows an authenticated remote
Pgpool-II deployments that run in watchdog-based high-availability clustering mode can have an arbitrary watchdog node p
Client certificate authentication in Pgpool-II can be bypassed by a remote unauthenticated attacker because affected ver
Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0
Pgpool-II writes sensitive cluster configuration and topology information into its log files, allowing an authenticated
Exploit-DB