# CVE-2026-92870: Pgpool-II stack-based buffer overflow

Source: https://junglewise.ai/threats/cve-2026-92870-a-stack-based-buffer-overflow-vulnerability-exists-in-pgpool-ii  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-92870 · Severity: high · CVSS 7.5 · Published 2026-09-30

Pgpool-II is a connection pooler and replication manager for PostgreSQL databases used in enterprise environments. CVE-2026-92870 is a stack-based buffer overflow vulnerability in watchdog failover message handling that allows an unauthenticated attacker to crash the process and potentially execute arbitrary code by sending a specially crafted message. This can lead to database unavailability and potential system compromise.

Technologies: [Pgpool Global Development Group Pgpool-II](https://junglewise.ai/threats/technologies/pgpool-ii). Vendors: [Pgpool Global Development Group](https://junglewise.ai/threats/vendors/pgpool-global-development-group).

## Quick answers

**Is CVE-2026-92870 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92870 being exploited in the wild.

**How severe is CVE-2026-92870?** High severity, with a CVSS score of 7.5, published 30 September 2026.

**Which products and versions are affected?** Pgpool Global Development Group Pgpool-II 3.5 through 4.7.2 (fixed in 4.7.3, 4.6.8, 4.5.13, 4.4.18, 4.3.21).

**Is there a fix for CVE-2026-92870?** A patch was published on 2026-09-29: Versions 4.7.3, 4.6.8, 4.5.13, 4.4.18, and 4.3.21 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92870 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92870?** Check whether you run Pgpool Global Development Group Pgpool-II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in Pgpool-II's watchdog failover message processing (CWE-121) that can be triggered by sending malformed failover messages over the network without authentication. The vulnerability allows an attacker to write arbitrary-length data to the stack, corrupting memory and crashing the Pgpool-II process. Patches are available in versions 4.7.3, 4.6.8, 4.5.13, 4.4.18, and 4.3.21.

## Affected products

- Pgpool Global Development Group Pgpool-II 3.5 through 4.7.2 (fixed in 4.7.3, 4.6.8, 4.5.13, 4.4.18, 4.3.21)

## Timeline

- 2026-09-29: disclosed
- 2026-09-29: patched: Versions 4.7.3, 4.6.8, 4.5.13, 4.4.18, and 4.3.21 released

## References

- [https://jvn.jp/en/jp/JVN22475874/](https://jvn.jp/en/jp/JVN22475874/)
- [https://pgpool.net/news/2026-09-29/](https://pgpool.net/news/2026-09-29/)

## Related threats

- [Pgpool-II authentication bypass in watchdog promotion](https://junglewise.ai/threats/cve-2026-92873-pgpool-ii-contains-an-incorrect-implementation-of-an)
- [Pgpool-II sensitive information insertion into log file](https://junglewise.ai/threats/cve-2026-92872-pgpool-ii-inserts-sensitive-information-into-log-file-which-may)
- [Pgpool-II NULL pointer dereference in watchdog](https://junglewise.ai/threats/cve-2026-92871-a-null-pointer-dereference-vulnerability-exists-in-pgpool-ii)
- [Pgpool-II out-of-bounds write in watchdog message processing](https://junglewise.ai/threats/cve-2026-92869-an-out-of-bounds-write-vulnerability-exists-in-pgpool-ii-which)
- [Pgpool-II client certificate authentication bypass via NUL byte injection](https://junglewise.ai/threats/cve-2026-92868-an-improper-certificate-validation-vulnerability-exists-in-pgpool)