CWE data temporarily unavailableCWE data is currently experiencing intermittent outages, which may cause incomplete section loading on CVE pages. We are actively working on a fix.

CVE-2026-92871

Description

A flaw was found in pgpool-II. A remote, unauthenticated attacker could cause a Denial of Service (DoS) due to a NULL pointer dereference in the watchdog component. Exploiting this vulnerability leads to abnormal termination of the watchdog process.

Statement

This vulnerability is rated as Important because an unauthenticated remote attacker can crash the watchdog daemon over the network, causing a denial of service and disrupting cluster high-availability coordination. Standalone deployments where the watchdog subsystem is disabled are not exposed to this issue. In clustered configurations, exposure is limited when watchdog communication ports are restricted to private, trusted cluster networks in accordance with standard deployment practices.

Mitigation

Restrict network access to the pgpool-II watchdog service to trusted cluster nodes using firewall rules, or disable the watchdog process if high-availability clustering is not required:

1. Limit watchdog communication ports (default TCP port 9000 and heartbeat port 9694) to authorized cluster peers using firewalld:

# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_NODE_IP>" port port="9000" protocol="tcp" accept'
# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="9000" protocol="tcp" drop'
# firewall-cmd --reload

2. Alternatively, if watchdog clustering is not utilized, disable it in `/etc/pgpool-II/pgpool.conf`:

use_watchdog = off
Apply the configuration change by restarting the service:
# systemctl restart pgpool.service

Caveats:
Disabling watchdog removes automated node failover and split-brain detection among pgpool-II instances. Restricting port access via firewall requires adding rich rules for each authorized cluster member.

Warning: Restarting or reloading the pgpool service interrupts active database connections and causes temporary downtime.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.