[Japanese]

JVNDB-2026-000140

Multiple vulnerabilities in Pgpool-II

Overview

Pgpool-II provided by Pgpool Global Development Group contains multiple vulnerabilities listed below:
  • Out-of-bounds Write (CWE-787) - CVE-2026-92867
  • Improper Certificate Validation (CWE-295) - CVE-2026-92868
  • Out-of-bounds Write (CWE-787) - CVE-2026-92869
  • Stack-based Buffer Overflow (CWE-121) - CVE-2026-92870
  • NULL Pointer Dereference (CWE-476) - CVE-2026-92871
  • Insertion of Sensitive Information into Log File (CWE-532) - CVE-2026-92872
  • Incorrect Implementation of Authentication Algorithm (CWE-303) - CVE-2026-92873
Emond Papegaaij of Topicus Security reported these vulnerabilities to Pgpool Global Development Group and coordinated. Pgpool Global Development Group and JPCERT/CC published respective advisories in order to notify users of this vulnerability.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 8.8 (High) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS v4 Severity
Base Metrics: 8.7 (High) [IPA Score]
  • Access Vector (AV): Network
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): Low
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): High
  • Integrity Impact (VI): High
  • Availability Impact (VA): High
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
The above CVSS base scores have been assigned for CVE-2026-92867

CVSS v3 Severity
Base Metrics: 6.5(Medium) [IPA Score]
  • Access Vector : Network
  • Attack Complexity : Low
  • Privileges Required : None
  • User Interaction : None
  • Scope : Unchanged
  • Confidentiality Impact : Low
  • Integrity Impact : Low
  • Availability Impact : None
CVSS v4 Severity
Base Metrics: 6.9 (Medium) [IPA Score]
  • Access Vector (AV): Network
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): None
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): Low
  • Integrity Impact (VI): Low
  • Availability Impact (VA): None
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
The above CVSS base scores have been assigned for CVE-2026-92868

CVSS v3 Severity
Base Metrics: 6.5(Medium) [IPA Score]
  • Access Vector : Network
  • Attack Complexity : Low
  • Privileges Required : Low
  • User Interaction : None
  • Scope : Unchanged
  • Confidentiality Impact : None
  • Integrity Impact : None
  • Availability Impact : High
CVSS v4 Severity
Base Metrics: 7.1 (High) [IPA Score]
  • Access Vector (AV): Network
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): Low
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): None
  • Integrity Impact (VI): None
  • Availability Impact (VA): High
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
The above CVSS base scores have been assigned for CVE-2026-92869

CVSS v3 Severity
Base Metrics: 7.5(High) [IPA Score]
  • Access Vector : Network
  • Attack Complexity : Low
  • Privileges Required : None
  • User Interaction : None
  • Scope : Unchanged
  • Confidentiality Impact : None
  • Integrity Impact : None
  • Availability Impact : High
CVSS v4 Severity
Base Metrics: 8.7 (High) [IPA Score]
  • Access Vector (AV): Network
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): None
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): None
  • Integrity Impact (VI): None
  • Availability Impact (VA): High
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
The above CVSS base scores have been assigned for CVE-2026-92870

CVSS v3 Severity
Base Metrics: 7.5(High) [IPA Score]
  • Access Vector : Network
  • Attack Complexity : Low
  • Privileges Required : None
  • User Interaction : None
  • Scope : Unchanged
  • Confidentiality Impact : None
  • Integrity Impact : None
  • Availability Impact : High
CVSS v4 Severity
Base Metrics: 8.7 (High) [IPA Score]
  • Access Vector (AV): Network
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): None
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): None
  • Integrity Impact (VI): None
  • Availability Impact (VA): High
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
The above CVSS base scores have been assigned for CVE-2026-92871

CVSS v3 Severity
Base Metrics: 4.3(Medium) [IPA Score]
  • Access Vector : Network
  • Attack Complexity : Low
  • Privileges Required : Low
  • User Interaction : None
  • Scope : Unchanged
  • Confidentiality Impact : Low
  • Integrity Impact : None
  • Availability Impact : None
CVSS v4 Severity
Base Metrics: 5.3 (Medium) [IPA Score]
  • Access Vector (AV): Network
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): Low
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): Low
  • Integrity Impact (VI): None
  • Availability Impact (VA): None
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
The above CVSS base scores have been assigned for CVE-2026-92872

CVSS v3 Severity
Base Metrics: 7.3(High) [IPA Score]
  • Access Vector : Network
  • Attack Complexity : Low
  • Privileges Required : None
  • User Interaction : None
  • Scope : Unchanged
  • Confidentiality Impact : Low
  • Integrity Impact : Low
  • Availability Impact : Low
CVSS v4 Severity
Base Metrics: 6.9 (Medium) [IPA Score]
  • Access Vector (AV): Network
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): None
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): Low
  • Integrity Impact (VI): Low
  • Availability Impact (VA): Low
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
The above CVSS base scores have been assigned for CVE-2026-92873
Affected Products


PgPool Global Development Group
  • Pgpool-II Versions 4.7.0 to 4.7.2 (CVE-2026-92867, CVE-2026-92869, CVE-2026-92870, CVE-2026-92871, CVE-2026-92872, CVE-2026-92873, CVE-2026-92868)
  • Pgpool-II versions 4.6.0 to 4.6.7 (CVE-2026-92867, CVE-2026-92869, CVE-2026-92870, CVE-2026-92871, CVE-2026-92872, CVE-2026-92873, CVE-2026-92868)
  • Pgpool-II versions 4.5.0 to 4.5.12 (CVE-2026-92867, CVE-2026-92869, CVE-2026-92870, CVE-2026-92871, CVE-2026-92872, CVE-2026-92873, CVE-2026-92868)
  • Pgpool-II versions 4.4.0 to 4.4.17 (CVE-2026-92867, CVE-2026-92869, CVE-2026-92870, CVE-2026-92871, CVE-2026-92872, CVE-2026-92873, CVE-2026-92868)
  • Pgpool-II versions 4.3.0 to 4.3.20 (CVE-2026-92867, CVE-2026-92869, CVE-2026-92870, CVE-2026-92871, CVE-2026-92872, CVE-2026-92873, CVE-2026-92868)
  • Pgpool-II all versions from the 3.5.x series through the 4.2.x series (CVE-2026-92867, CVE-2026-92869, CVE-2026-92870, CVE-2026-92871, CVE-2026-92872, CVE-2026-92873)
  • Pgpool-II all versions from the 4.0.x series through the 4.2.x series (CVE-2026-92868)

Impact

  • Abnormal process termination, and arbitrary code execution (CVE-2026-92867)
  • Client certificate authentication bypass (CVE-2026-92868)
  • Abnormal process termination (CVE-2026-92869, CVE-2026-92870)
  • Abnormal termination of the watchdog process (CVE-2026-92871)
  • Cluster information leak (CVE-2026-92872)
  • Promotion of an arbitrary watchdog node to the leader node (CVE-2026-92873)
Solution

[Update the Software]
Update the software to the latest version according to the information provided by the developer.
The following versions are released to address the vulnerabilities:
  • Pgpool-II 4.7.3
  • Pgpool-II 4.6.8
  • Pgpool-II 4.5.13
  • Pgpool-II 4.4.18
  • Pgpool-II 4.3.21
Support for Pgpool-II versions 3.5 through 4.2 has ended and no further fixes will be released; therefore, if you are using a version prior to 4.3, upgrading to the latest version mentioned above is recommended.
Vendor Information

PgPool Global Development Group
CWE (What is CWE?)

  1. Buffer Errors(CWE-119) [IPA Evaluation]
  2. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2026-92867
  2. CVE-2026-92868
  3. CVE-2026-92869
  4. CVE-2026-92870
  5. CVE-2026-92871
  6. CVE-2026-92872
  7. CVE-2026-92873
References

  1. JVN : JVN#22475874
Revision History

  • [2026/09/29]
      Web page was published

Date Public2026/09/29
Date First Published2026/09/29
Date Last Updated2026/09/29