The Pgpool Global Development Group has announced the release of Pgpool-II 4.7.3, 4.6.8, 4.5.13, 4.4.18, and 4.3.21. These minor updates include critical security fixes for the PostgreSQL connection pooler and load balancer, which provides connection pooling, load balancing, and automatic failover. All users are strongly encouraged to upgrade immediately.
- CVE-2026-92867: A vulnerability in watchdog message processing during failover allows an attacker to write an arbitrary 32-bit value to an arbitrary memory address by sending a malformed message.
- CVE-2026-92868: When a client connects to Pgpool-II using certificate authentication, the server fails to properly handle
NULbytes (\0) in the domain name within the Common Name (CN) field of the client's X.509 certificate. This flaw permits a malicious client to connect as another user without a password. - CVE-2026-92869: A separate vulnerability in watchdog message processing allows an attacker to overwrite memory beyond the boundaries of fixed-size arrays by sending a malformed message.
- Arbitrary-length data write: A vulnerability in the handling of failover messages by watchdog enables writes of arbitrary-length data, potentially leading to memory corruption.
These vulnerabilities highlight the importance of keeping Pgpool-II up to date. The memory corruption issues in watchdog could be exploited for remote code execution or denial of service, while the certificate authentication bypass directly undermines security controls. Developers and administrators running any of the affected versions should prioritize upgrading to the latest minor release. The updates are available for download from the official Pgpool-II website.
Source: https://www.postgresql.org/about/news/pgpool-ii-473-468-4513-4418-and-4321-released-3390/