CVE-2026-92867
Received Received - Intake

Out-of-Bounds Write in Pgpool-II

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: JPCERT/CC

Description
An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-92867
EUVD
EUVD-2026-89657

Affected Vendors & Products

Showing 11 associated CPEs
Vendor Product Version / Range
pgpool pgpool 4.7.3
pgpool pgpool 4.6.8
pgpool pgpool 4.5.13
pgpool pgpool 4.4.18
pgpool pgpool 4.3.21
pgpool pgpool From 4.7.0 (inc) to 4.7.2 (inc)
pgpool pgpool From 4.6.0 (inc) to 4.6.7 (inc)
pgpool pgpool From 4.5.0 (inc) to 4.5.12 (inc)
pgpool pgpool From 4.4.0 (inc) to 4.4.17 (inc)
pgpool pgpool From 4.3.0 (inc) to 4.3.20 (inc)
pgpool pgpool From 3.5.0 (inc) to 4.2.999 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-92867 is an out-of-bounds write vulnerability in Pgpool-II. It allows an authenticated attacker to write arbitrary 32-bit values to any memory address by sending a malformed watchdog message during failover. This occurs due to improper handling of watchdog message processing, which can lead to abnormal process termination or arbitrary code execution.

Detection Guidance

Check Pgpool-II version using 'pgpool -v' or 'apt list --installed | grep pgpool' for Debian-based systems. Monitor network traffic for malformed watchdog messages during failover events. Inspect logs for abnormal process terminations or authentication bypass attempts.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code or terminate processes abnormally on systems running vulnerable versions of Pgpool-II. If exploited, it may lead to unauthorized access, data breaches, or denial of service. Systems using affected versions (4.7.3, 4.6.8, 4.5.13, 4.4.18, 4.3.21) are at risk.

Compliance Impact

The vulnerability may lead to unauthorized access or arbitrary code execution, which could compromise data confidentiality and integrity. This could violate GDPR's data protection requirements and HIPAA's security rules for protected health information if exploited.

Mitigation Strategies
  • Upgrade Pgpool-II to patched versions (4.7.3, 4.6.8, 4.5.13, 4.4.18, or 4.3.21) immediately.
  • Disable watchdog functionality if not required, as the vulnerability involves watchdog message processing.
  • Restrict network access to Pgpool-II instances to trusted sources only.
  • Review and enforce strict client certificate validation policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart