CVE-2026-92869
Description
A flaw was found in Pgpool-II. An out-of-bounds write vulnerability allows a remote authenticated attacker to cause a Denial of Service (DoS) by forcing the service to terminate unexpectedly. The issue occurs when the application attempts to write data beyond allocated memory buffer boundaries, resulting in an abnormal process crash.
Statement
This vulnerability is rated as Moderate because exploitation requires authenticated network access and is strictly limited to causing a denial of service via process termination, without impacting confidentiality or system integrity. In typical Red Hat Enterprise Linux environments, Pgpool-II is not provided as a core component, substantially limiting exposure to community or specialized installations. The flaw cannot be triggered anonymously, meaning an attacker must possess valid database credentials to force the daemon to crash.
Mitigation
Restrict network exposure by limiting access to the Pgpool-II service port to trusted hosts using firewall rules, or disable the service if Pgpool-II is not required.
1. Restrict incoming traffic to trusted IP addresses:
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP>
firewall-cmd --permanent --remove-port=9999/tcp
firewall-cmd --reload
2. If connection pooling is not required, stop and disable the service:
systemctl stop pgpool
systemctl disable pgpool
Caveats:
Restricting access prevents unauthorized network endpoints from reaching the service. Stopping the service removes connection routing and pooling capabilities, requiring client applications to communicate directly with backend database servers.
Warning: Applying firewall reload rules or stopping the pgpool service terminates active client sessions and disrupts connection pooling availability.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
