# CVE-2026-92871: Pgpool-II NULL pointer dereference in watchdog

Source: https://junglewise.ai/threats/cve-2026-92871-a-null-pointer-dereference-vulnerability-exists-in-pgpool-ii  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-92871 · Severity: high · CVSS 7.5 · Published 2026-09-30

Pgpool-II is a middleware that manages PostgreSQL database clustering and failover. A NULL pointer dereference vulnerability in its watchdog authentication mechanism allows an unauthenticated attacker to crash the watchdog process by sending specially crafted messages, causing loss of high-availability protection and potential service outages.

Technologies: [Pgpool Global Development Group Pgpool-II](https://junglewise.ai/threats/technologies/pgpool-ii). Vendors: [Pgpool Global Development Group](https://junglewise.ai/threats/vendors/pgpool-global-development-group).

## Quick answers

**Is CVE-2026-92871 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92871 being exploited in the wild.

**How severe is CVE-2026-92871?** High severity, with a CVSS score of 7.5, published 30 September 2026.

**Which products and versions are affected?** Pgpool Global Development Group Pgpool-II 3.5 through 4.7.2; fixed in 4.3.21, 4.4.18, 4.5.13, 4.6.8, 4.7.3.

**Is there a fix for CVE-2026-92871?** A patch was published on 2026-09-29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92871 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92871?** Check whether you run Pgpool Global Development Group Pgpool-II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-92871 is a NULL pointer dereference (CWE-476) in Pgpool-II's watchdog inter-node authentication. When an authentication key is configured, malformed watchdog messages that omit authentication information trigger the defect, allowing unauthenticated attackers on the network to crash the watchdog process. A fix is available in patched versions.

## Affected products

- Pgpool Global Development Group Pgpool-II 3.5 through 4.7.2; fixed in 4.3.21, 4.4.18, 4.5.13, 4.6.8, 4.7.3

## Timeline

- 2026-09-29: disclosed
- 2026-09-29: patched

## References

- [https://jvn.jp/en/jp/JVN22475874/](https://jvn.jp/en/jp/JVN22475874/)
- [https://pgpool.net/news/2026-09-29/](https://pgpool.net/news/2026-09-29/)

## Related threats

- [Pgpool-II authentication bypass in watchdog promotion](https://junglewise.ai/threats/cve-2026-92873-pgpool-ii-contains-an-incorrect-implementation-of-an)
- [Pgpool-II sensitive information insertion into log file](https://junglewise.ai/threats/cve-2026-92872-pgpool-ii-inserts-sensitive-information-into-log-file-which-may)
- [Pgpool-II stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-92870-a-stack-based-buffer-overflow-vulnerability-exists-in-pgpool-ii)
- [Pgpool-II out-of-bounds write in watchdog message processing](https://junglewise.ai/threats/cve-2026-92869-an-out-of-bounds-write-vulnerability-exists-in-pgpool-ii-which)
- [Pgpool-II client certificate authentication bypass via NUL byte injection](https://junglewise.ai/threats/cve-2026-92868-an-improper-certificate-validation-vulnerability-exists-in-pgpool)