CVE-2026-92870
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.
Risk Assessment
Risk of process crash and potential service instability.
Recommendation
Update Pgpool-II to a patched version and restrict network access to the service.
Other vulnerabilities in Pgpool-II
See all- CVE-2026-92873High
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.
- CVE-2026-92872Medium
Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.
- CVE-2026-92871High
A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.
- CVE-2026-92867High
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.
- CVE-2026-92869Medium
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.
- CVE-2026-92868Medium
An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.
Original NVD description (English source)
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS