# CVE-2026-92869: Pgpool-II out-of-bounds write in watchdog message processing

Source: https://junglewise.ai/threats/cve-2026-92869-an-out-of-bounds-write-vulnerability-exists-in-pgpool-ii-which  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-92869 · Severity: medium · CVSS 6.5 · Published 2026-09-30

Pgpool-II is a connection pooling and load balancing middleware for PostgreSQL databases. An authenticated attacker can send malformed watchdog messages to overwrite memory beyond fixed-size arrays, causing the Pgpool-II process to crash. This denial-of-service vulnerability affects deployments using Pgpool-II for database failover and clustering.

Technologies: [Pgpool Global Development Group Pgpool-II](https://junglewise.ai/threats/technologies/pgpool-ii). Vendors: [Pgpool Global Development Group](https://junglewise.ai/threats/vendors/pgpool-global-development-group).

## Quick answers

**Is CVE-2026-92869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92869 being exploited in the wild.

**How severe is CVE-2026-92869?** Medium severity, with a CVSS score of 6.5, published 30 September 2026.

**Which products and versions are affected?** Pgpool Global Development Group Pgpool-II 3.5 through 4.7.2; patched in 4.3.21, 4.4.18, 4.5.13, 4.6.8, 4.7.3.

**Is there a fix for CVE-2026-92869?** A patch was published on 2026-09-29: Versions 4.3.21, 4.4.18, 4.5.13, 4.6.8, 4.7.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92869 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92869?** Check whether you run Pgpool Global Development Group Pgpool-II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-92869 is a stack-based buffer overflow (CWE-121) triggered by malformed watchdog messages during failover. The vulnerability requires network access and affects unauthenticated connections on the watchdog port. An attacker can crash Pgpool-II processes (denial of service); patched versions 4.3.21+ are available.

## Affected products

- Pgpool Global Development Group Pgpool-II 3.5 through 4.7.2; patched in 4.3.21, 4.4.18, 4.5.13, 4.6.8, 4.7.3

## Timeline

- 2026-09-29: disclosed
- 2026-09-29: patched: Versions 4.3.21, 4.4.18, 4.5.13, 4.6.8, 4.7.3 released

## References

- [https://jvn.jp/en/jp/JVN22475874/](https://jvn.jp/en/jp/JVN22475874/)
- [https://pgpool.net/news/2026-09-29/](https://pgpool.net/news/2026-09-29/)

## Related threats

- [Pgpool-II authentication bypass in watchdog promotion](https://junglewise.ai/threats/cve-2026-92873-pgpool-ii-contains-an-incorrect-implementation-of-an)
- [Pgpool-II sensitive information insertion into log file](https://junglewise.ai/threats/cve-2026-92872-pgpool-ii-inserts-sensitive-information-into-log-file-which-may)
- [Pgpool-II NULL pointer dereference in watchdog](https://junglewise.ai/threats/cve-2026-92871-a-null-pointer-dereference-vulnerability-exists-in-pgpool-ii)
- [Pgpool-II stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-92870-a-stack-based-buffer-overflow-vulnerability-exists-in-pgpool-ii)
- [Pgpool-II client certificate authentication bypass via NUL byte injection](https://junglewise.ai/threats/cve-2026-92868-an-improper-certificate-validation-vulnerability-exists-in-pgpool)