Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-92873 (GCVE-0-2026-92873)

Vulnerability from nvd – Published: 2026-09-30 07:51 – Updated: 2026-09-30 07:51

Summary

Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.

Severity

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-303 - Incorrect Implementation of Authentication Algorithm

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-303",
              "description": "Incorrect Implementation of Authentication Algorithm",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:51:52.401Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92873",
    "datePublished": "2026-09-30T07:51:52.401Z",
    "dateReserved": "2026-09-17T06:31:54.745Z",
    "dateUpdated": "2026-09-30T07:51:52.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92872 (GCVE-0-2026-92872)

Vulnerability from nvd – Published: 2026-09-30 07:47 – Updated: 2026-09-30 07:47

Summary

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-532 - Insertion of sensitive information into log file

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "Insertion of sensitive information into log file",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:47:50.234Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92872",
    "datePublished": "2026-09-30T07:47:50.234Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T07:47:50.234Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92871 (GCVE-0-2026-92871)

Vulnerability from nvd – Published: 2026-09-30 07:47 – Updated: 2026-09-30 15:28

Summary

A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 14:56 UTC

CWE

CWE-476 - NULL pointer dereference

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92871",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T14:56:12.370889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:10.394Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL pointer dereference",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:47:32.091Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92871",
    "datePublished": "2026-09-30T07:47:32.091Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T15:28:10.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92870 (GCVE-0-2026-92870)

Vulnerability from nvd – Published: 2026-09-30 07:21 – Updated: 2026-09-30 07:21

Summary

A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-121 - Stack-based buffer overflow

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based buffer overflow",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:21:24.156Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92870",
    "datePublished": "2026-09-30T07:21:24.156Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T07:21:24.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92869 (GCVE-0-2026-92869)

Vulnerability from nvd – Published: 2026-09-30 07:21 – Updated: 2026-09-30 07:21

Summary

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-787 - Out-of-bounds Write

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:21:09.653Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92869",
    "datePublished": "2026-09-30T07:21:09.653Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T07:21:09.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92868 (GCVE-0-2026-92868)

Vulnerability from nvd – Published: 2026-09-30 07:20 – Updated: 2026-09-30 07:20

Summary

An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-295 - Improper certificate validation

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 4.0.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "4.0.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper certificate validation",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:20:48.300Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92868",
    "datePublished": "2026-09-30T07:20:48.300Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T07:20:48.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92867 (GCVE-0-2026-92867)

Vulnerability from nvd – Published: 2026-09-30 07:20 – Updated: 2026-09-30 07:20

Summary

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-787 - Out-of-bounds Write

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:20:27.931Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92867",
    "datePublished": "2026-09-30T07:20:27.931Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T07:20:27.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-46801 (GCVE-0-2025-46801)

Vulnerability from nvd – Published: 2025-05-19 07:14 – Updated: 2025-11-03 17:44

Summary

Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-19 16:02 UTC

CWE

CWE-305 - Authentication bypass by primary weakness

Assigner

jpcert jpcert root Scorecard

References

3 references

URL	Tags
https://www.pgpool.net/mediawiki/index.php/Main_P…
https://jvn.jp/en/jp/JVN06238225/
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

7 products

Vendor	Product	Version
PgPool Global Development Group	Pgpool-II	Affected: 4.6.0
PgPool Global Development Group	Pgpool-II	Affected: 4.5.0 to 4.5.6
PgPool Global Development Group	Pgpool-II	Affected: 4.4.0 to 4.4.11
PgPool Global Development Group	Pgpool-II	Affected: 4.3.0 to 4.3.14
PgPool Global Development Group	Pgpool-II	Affected: 4.2.0 to 4.2.21
PgPool Global Development Group	Pgpool-II	Affected: All versions of 4.1 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 4.0 series

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-46801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-19T16:02:35.673653Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-19T16:02:56.831Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:50.344Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00014.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.6.0"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.5.0 to 4.5.6"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.4.0 to 4.4.11"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0 to 4.3.14"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.2.0 to 4.2.21"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 4.1 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 4.0 series"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "Authentication bypass by primary weakness",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-19T07:14:45.304Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.pgpool.net/mediawiki/index.php/Main_Page#News"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN06238225/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-46801",
    "datePublished": "2025-05-19T07:14:45.304Z",
    "dateReserved": "2025-04-30T08:26:53.970Z",
    "dateUpdated": "2025-11-03T17:44:50.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-45624 (GCVE-0-2024-45624)

Vulnerability from nvd – Published: 2024-09-12 04:33 – Updated: 2025-11-03 22:16

Summary

Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized for the user may be retrieved.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-12 14:18 UTC

CWE

Exposure of Sensitive Information Due to Incompatible Policies
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

jpcert jpcert root Scorecard

References

3 references

URL	Tags
https://www.pgpool.net/mediawiki/index.php/Main_P…
https://jvn.jp/en/jp/JVN67456481/
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

13 products

Vendor	Product	Version
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.2 series
PgPool Global Development Group	Pgpool-II	Affected: 4.5.0 to 4.5.3 (4.5 series)
PgPool Global Development Group	Pgpool-II	Affected: 4.4.0 to 4.4.8 (4.4 series)
PgPool Global Development Group	Pgpool-II	Affected: 4.3.0 to 4.3.11 (4.3 series)
PgPool Global Development Group	Pgpool-II	Affected: 4.2.0 to 4.2.18 (4.2 series)
PgPool Global Development Group	Pgpool-II	Affected: 4.1.0 to 4.1.21 (4.1 series)
PgPool Global Development Group	Pgpool-II	Affected: All versions of 4.0 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.7 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.6 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.5 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.4 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.3 series
pgpool	pgpool-ii	Affected: 3.2.0 , ≤ 4.5.3 (custom) cpe:2.3:a:pgpool:pgpool-ii::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:pgpool:pgpool-ii:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pgpool-ii",
            "vendor": "pgpool",
            "versions": [
              {
                "lessThanOrEqual": "4.5.3",
                "status": "affected",
                "version": "3.2.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45624",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-12T14:18:18.392471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T14:22:14.553Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:16:02.168Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00015.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.2 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.5.0 to 4.5.3 (4.5 series)"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.4.0 to 4.4.8 (4.4 series)"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0 to 4.3.11 (4.3 series)"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.2.0 to 4.2.18 (4.2 series)"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0 to 4.1.21 (4.1 series)"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 4.0 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.7 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.6 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.5 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.4 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.3 series"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized for the user may be retrieved."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Exposure of Sensitive Information Due to Incompatible Policies",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-12T04:33:40.437Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.pgpool.net/mediawiki/index.php/Main_Page#News"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN67456481/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-45624",
    "datePublished": "2024-09-12T04:33:40.437Z",
    "dateReserved": "2024-09-03T01:04:05.769Z",
    "dateUpdated": "2025-11-03T22:16:02.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-22332 (GCVE-0-2023-22332)

Vulnerability from nvd – Published: 2023-01-30 00:00 – Updated: 2025-11-03 21:47

Summary

Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series. A specific database user's authentication information may be obtained by another database user. As a result, the information stored in the database may be altered and/or database may be suspended by a remote attacker who successfully logged in the product with the obtained credentials.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-28 14:06 UTC

CWE

Information Disclosure
CWE-312 - Cleartext Storage of Sensitive Information

Assigner

jpcert jpcert root Scorecard

References

3 references

URL	Tags
https://www.pgpool.net/mediawiki/index.php/Main_P…
https://jvn.jp/en/jp/JVN72418815/
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

1 product

Vendor	Product	Version
PgPool Global Development Group	Pgpool-II	Affected: 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:47:15.461Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.pgpool.net/mediawiki/index.php/Main_Page#News"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN72418815/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00015.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-22332",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-28T14:06:17.841607Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-312",
                "description": "CWE-312 Cleartext Storage of Sensitive Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-28T14:06:55.023Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series. A specific database user\u0027s authentication information may be obtained by another database user. As a result, the information stored in the database may be altered and/or database may be suspended by a remote attacker who successfully logged in the product with the obtained credentials."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-30T00:00:00.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.pgpool.net/mediawiki/index.php/Main_Page#News"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN72418815/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-22332",
    "datePublished": "2023-01-30T00:00:00.000Z",
    "dateReserved": "2022-12-28T00:00:00.000Z",
    "dateUpdated": "2025-11-03T21:47:15.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2018-16203 (GCVE-0-2018-16203)

Vulnerability from nvd – Published: 2019-01-09 22:00 – Updated: 2024-08-05 10:17

Summary

PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors.

Severity

No CVSS data available.

CWE

Fails to restrict access

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/mediawiki/index.php/Main_Page	x_refsource_MISC
https://jvn.jp/en/jp/JVN13199224/index.html	third-party-advisoryx_refsource_JVN

Impacted products

1 product

Vendor	Product	Version
PgPool Global Development Group	PgpoolAdmin	Affected: 4.0 and earlier

Date Public

2019-01-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:17:38.333Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
          },
          {
            "name": "JVN#13199224",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PgpoolAdmin",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.0 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2019-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Fails to restrict access",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-01-09T21:57:01.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
        },
        {
          "name": "JVN#13199224",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2018-16203",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PgpoolAdmin",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "PgPool Global Development Group"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Fails to restrict access"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://pgpool.net/mediawiki/index.php/Main_Page",
              "refsource": "MISC",
              "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
            },
            {
              "name": "JVN#13199224",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2018-16203",
    "datePublished": "2019-01-09T22:00:00.000Z",
    "dateReserved": "2018-08-30T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:17:38.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-92873 (GCVE-0-2026-92873)

Vulnerability from cvelistv5 – Published: 2026-09-30 07:51 – Updated: 2026-09-30 07:51

Summary

Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.

Severity

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-303 - Incorrect Implementation of Authentication Algorithm

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-303",
              "description": "Incorrect Implementation of Authentication Algorithm",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:51:52.401Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92873",
    "datePublished": "2026-09-30T07:51:52.401Z",
    "dateReserved": "2026-09-17T06:31:54.745Z",
    "dateUpdated": "2026-09-30T07:51:52.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92872 (GCVE-0-2026-92872)

Vulnerability from cvelistv5 – Published: 2026-09-30 07:47 – Updated: 2026-09-30 07:47

Summary

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-532 - Insertion of sensitive information into log file

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "Insertion of sensitive information into log file",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:47:50.234Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92872",
    "datePublished": "2026-09-30T07:47:50.234Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T07:47:50.234Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92871 (GCVE-0-2026-92871)

Vulnerability from cvelistv5 – Published: 2026-09-30 07:47 – Updated: 2026-09-30 15:28

Summary

A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 14:56 UTC

CWE

CWE-476 - NULL pointer dereference

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92871",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T14:56:12.370889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:10.394Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL pointer dereference",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:47:32.091Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92871",
    "datePublished": "2026-09-30T07:47:32.091Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T15:28:10.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92870 (GCVE-0-2026-92870)

Vulnerability from cvelistv5 – Published: 2026-09-30 07:21 – Updated: 2026-09-30 07:21

Summary

A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-121 - Stack-based buffer overflow

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based buffer overflow",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:21:24.156Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92870",
    "datePublished": "2026-09-30T07:21:24.156Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T07:21:24.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92869 (GCVE-0-2026-92869)

Vulnerability from cvelistv5 – Published: 2026-09-30 07:21 – Updated: 2026-09-30 07:21

Summary

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-787 - Out-of-bounds Write

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:21:09.653Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92869",
    "datePublished": "2026-09-30T07:21:09.653Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T07:21:09.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92868 (GCVE-0-2026-92868)

Vulnerability from cvelistv5 – Published: 2026-09-30 07:20 – Updated: 2026-09-30 07:20

Summary

An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-295 - Improper certificate validation

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 4.0.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "4.0.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper certificate validation",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:20:48.300Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92868",
    "datePublished": "2026-09-30T07:20:48.300Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T07:20:48.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92867 (GCVE-0-2026-92867)

Vulnerability from cvelistv5 – Published: 2026-09-30 07:20 – Updated: 2026-09-30 07:20

Summary

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-787 - Out-of-bounds Write

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

Impacted products

1 product

Vendor	Product	Version
Pgpool Global Development Group	Pgpool-II	Affected: 4.7.0 , ≤ 4.7.2 (semver) Affected: 4.6.0 , ≤ 4.6.7 (semver) Affected: 4.5.0 , ≤ 4.5.12 (semver) Affected: 4.4.0 , ≤ 4.4.17 (semver) Affected: 4.3.0 , ≤ 4.3.20 (semver) Affected: 3.5.x , ≤ 4.2.x (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pgpool-II",
          "vendor": "Pgpool Global Development Group",
          "versions": [
            {
              "lessThanOrEqual": "4.7.2",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.6.7",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.17",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.x",
              "status": "affected",
              "version": "3.5.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T07:20:27.931Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pgpool.net/news/2026-09-29/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN22475874/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-92867",
    "datePublished": "2026-09-30T07:20:27.931Z",
    "dateReserved": "2026-09-17T06:31:54.744Z",
    "dateUpdated": "2026-09-30T07:20:27.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-46801 (GCVE-0-2025-46801)

Vulnerability from cvelistv5 – Published: 2025-05-19 07:14 – Updated: 2025-11-03 17:44

Summary

Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-19 16:02 UTC

CWE

CWE-305 - Authentication bypass by primary weakness

Assigner

jpcert jpcert root Scorecard

References

3 references

URL	Tags
https://www.pgpool.net/mediawiki/index.php/Main_P…
https://jvn.jp/en/jp/JVN06238225/
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

7 products

Vendor	Product	Version
PgPool Global Development Group	Pgpool-II	Affected: 4.6.0
PgPool Global Development Group	Pgpool-II	Affected: 4.5.0 to 4.5.6
PgPool Global Development Group	Pgpool-II	Affected: 4.4.0 to 4.4.11
PgPool Global Development Group	Pgpool-II	Affected: 4.3.0 to 4.3.14
PgPool Global Development Group	Pgpool-II	Affected: 4.2.0 to 4.2.21
PgPool Global Development Group	Pgpool-II	Affected: All versions of 4.1 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 4.0 series

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-46801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-19T16:02:35.673653Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-19T16:02:56.831Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:50.344Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00014.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.6.0"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.5.0 to 4.5.6"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.4.0 to 4.4.11"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0 to 4.3.14"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.2.0 to 4.2.21"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 4.1 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 4.0 series"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "Authentication bypass by primary weakness",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-19T07:14:45.304Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.pgpool.net/mediawiki/index.php/Main_Page#News"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN06238225/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-46801",
    "datePublished": "2025-05-19T07:14:45.304Z",
    "dateReserved": "2025-04-30T08:26:53.970Z",
    "dateUpdated": "2025-11-03T17:44:50.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-45624 (GCVE-0-2024-45624)

Vulnerability from cvelistv5 – Published: 2024-09-12 04:33 – Updated: 2025-11-03 22:16

Summary

Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized for the user may be retrieved.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-12 14:18 UTC

CWE

Exposure of Sensitive Information Due to Incompatible Policies
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

jpcert jpcert root Scorecard

References

3 references

URL	Tags
https://www.pgpool.net/mediawiki/index.php/Main_P…
https://jvn.jp/en/jp/JVN67456481/
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

13 products

Vendor	Product	Version
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.2 series
PgPool Global Development Group	Pgpool-II	Affected: 4.5.0 to 4.5.3 (4.5 series)
PgPool Global Development Group	Pgpool-II	Affected: 4.4.0 to 4.4.8 (4.4 series)
PgPool Global Development Group	Pgpool-II	Affected: 4.3.0 to 4.3.11 (4.3 series)
PgPool Global Development Group	Pgpool-II	Affected: 4.2.0 to 4.2.18 (4.2 series)
PgPool Global Development Group	Pgpool-II	Affected: 4.1.0 to 4.1.21 (4.1 series)
PgPool Global Development Group	Pgpool-II	Affected: All versions of 4.0 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.7 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.6 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.5 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.4 series
PgPool Global Development Group	Pgpool-II	Affected: All versions of 3.3 series
pgpool	pgpool-ii	Affected: 3.2.0 , ≤ 4.5.3 (custom) cpe:2.3:a:pgpool:pgpool-ii::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:pgpool:pgpool-ii:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pgpool-ii",
            "vendor": "pgpool",
            "versions": [
              {
                "lessThanOrEqual": "4.5.3",
                "status": "affected",
                "version": "3.2.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45624",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-12T14:18:18.392471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T14:22:14.553Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:16:02.168Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00015.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.2 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.5.0 to 4.5.3 (4.5 series)"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.4.0 to 4.4.8 (4.4 series)"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0 to 4.3.11 (4.3 series)"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.2.0 to 4.2.18 (4.2 series)"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0 to 4.1.21 (4.1 series)"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 4.0 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.7 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.6 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.5 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.4 series"
            }
          ]
        },
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of 3.3 series"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized for the user may be retrieved."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Exposure of Sensitive Information Due to Incompatible Policies",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-12T04:33:40.437Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.pgpool.net/mediawiki/index.php/Main_Page#News"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN67456481/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-45624",
    "datePublished": "2024-09-12T04:33:40.437Z",
    "dateReserved": "2024-09-03T01:04:05.769Z",
    "dateUpdated": "2025-11-03T22:16:02.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-22332 (GCVE-0-2023-22332)

Vulnerability from cvelistv5 – Published: 2023-01-30 00:00 – Updated: 2025-11-03 21:47

Summary

Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series. A specific database user's authentication information may be obtained by another database user. As a result, the information stored in the database may be altered and/or database may be suspended by a remote attacker who successfully logged in the product with the obtained credentials.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-28 14:06 UTC

CWE

Information Disclosure
CWE-312 - Cleartext Storage of Sensitive Information

Assigner

jpcert jpcert root Scorecard

References

3 references

URL	Tags
https://www.pgpool.net/mediawiki/index.php/Main_P…
https://jvn.jp/en/jp/JVN72418815/
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

1 product

Vendor	Product	Version
PgPool Global Development Group	Pgpool-II	Affected: 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:47:15.461Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.pgpool.net/mediawiki/index.php/Main_Page#News"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN72418815/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00015.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-22332",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-28T14:06:17.841607Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-312",
                "description": "CWE-312 Cleartext Storage of Sensitive Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-28T14:06:55.023Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pgpool-II",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series. A specific database user\u0027s authentication information may be obtained by another database user. As a result, the information stored in the database may be altered and/or database may be suspended by a remote attacker who successfully logged in the product with the obtained credentials."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-30T00:00:00.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.pgpool.net/mediawiki/index.php/Main_Page#News"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN72418815/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-22332",
    "datePublished": "2023-01-30T00:00:00.000Z",
    "dateReserved": "2022-12-28T00:00:00.000Z",
    "dateUpdated": "2025-11-03T21:47:15.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2018-16203 (GCVE-0-2018-16203)

Vulnerability from cvelistv5 – Published: 2019-01-09 22:00 – Updated: 2024-08-05 10:17

Summary

PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors.

Severity

No CVSS data available.

CWE

Fails to restrict access

Assigner

jpcert jpcert root Scorecard

References

2 references

URL	Tags
https://pgpool.net/mediawiki/index.php/Main_Page	x_refsource_MISC
https://jvn.jp/en/jp/JVN13199224/index.html	third-party-advisoryx_refsource_JVN

Impacted products

1 product

Vendor	Product	Version
PgPool Global Development Group	PgpoolAdmin	Affected: 4.0 and earlier

Date Public

2019-01-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:17:38.333Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
          },
          {
            "name": "JVN#13199224",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PgpoolAdmin",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.0 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2019-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Fails to restrict access",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-01-09T21:57:01.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
        },
        {
          "name": "JVN#13199224",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2018-16203",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PgpoolAdmin",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "PgPool Global Development Group"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Fails to restrict access"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://pgpool.net/mediawiki/index.php/Main_Page",
              "refsource": "MISC",
              "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
            },
            {
              "name": "JVN#13199224",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2018-16203",
    "datePublished": "2019-01-09T22:00:00.000Z",
    "dateReserved": "2018-08-30T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:17:38.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

JVNDB-2026-000140

Vulnerability from jvndb - Published: 2026-09-29 06:53 - Updated:2026-09-29 06:53

Severity

8.8 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple vulnerabilities in Pgpool-II

Details

Pgpool-II provided by Pgpool Global Development Group contains multiple vulnerabilities listed below:

Out-of-bounds Write (CWE-787) - CVE-2026-92867
Improper Certificate Validation (CWE-295) - CVE-2026-92868
Out-of-bounds Write (CWE-787) - CVE-2026-92869
Stack-based Buffer Overflow (CWE-121) - CVE-2026-92870
NULL Pointer Dereference (CWE-476) - CVE-2026-92871
Insertion of Sensitive Information into Log File (CWE-532) - CVE-2026-92872
Incorrect Implementation of Authentication Algorithm (CWE-303) - CVE-2026-92873

Emond Papegaaij of Topicus Security reported these vulnerabilities to Pgpool Global Development Group and coordinated. Pgpool Global Development Group and JPCERT/CC published respective advisories in order to notify users of this vulnerability.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN22475874/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-92867
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-92868
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-92869
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-92870
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-92871
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-92872
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-92873
	Buffer Errors(CWE-119)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

PgPool Global Development Group

Pgpool-II

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000140.html",
  "dc:date": "2026-09-29T15:53+09:00",
  "dcterms:issued": "2026-09-29T15:53+09:00",
  "dcterms:modified": "2026-09-29T15:53+09:00",
  "description": "Pgpool-II provided by Pgpool Global Development Group contains multiple vulnerabilities listed below:\u003ca href=\u0027https://cwe.mitre.org/data/definitions/787.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/295.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/787.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/121.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/476.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/532.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/303.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eOut-of-bounds Write (CWE-787) - CVE-2026-92867\u003c/li\u003e\u003cli\u003eImproper Certificate Validation (CWE-295) - CVE-2026-92868\u003c/li\u003e\u003cli\u003eOut-of-bounds Write (CWE-787) - CVE-2026-92869\u003c/li\u003e\u003cli\u003eStack-based Buffer Overflow (CWE-121) - CVE-2026-92870\u003c/li\u003e\u003cli\u003eNULL Pointer Dereference (CWE-476) - CVE-2026-92871\u003c/li\u003e\u003cli\u003eInsertion of Sensitive Information into Log File (CWE-532) - CVE-2026-92872\u003c/li\u003e\u003cli\u003eIncorrect Implementation of Authentication Algorithm (CWE-303) - CVE-2026-92873\u003c/li\u003e\u003c/ul\u003eEmond Papegaaij of Topicus Security reported these vulnerabilities to Pgpool Global Development Group and coordinated. Pgpool Global Development Group and JPCERT/CC published respective advisories in order to notify users of this vulnerability.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000140.html",
  "sec:cpe": {
    "#text": "cpe:/a:pgpool:pgpool-ii",
    "@product": "Pgpool-II",
    "@vendor": "PgPool Global Development Group",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "8.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000140",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN22475874/index.html",
      "@id": "JVN#22475874",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-92867",
      "@id": "CVE-2026-92867",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-92868",
      "@id": "CVE-2026-92868",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-92869",
      "@id": "CVE-2026-92869",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-92870",
      "@id": "CVE-2026-92870",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-92871",
      "@id": "CVE-2026-92871",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-92872",
      "@id": "CVE-2026-92872",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-92873",
      "@id": "CVE-2026-92873",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-119",
      "@title": "Buffer Errors(CWE-119)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in Pgpool-II"
}

JVNDB-2025-000031

Vulnerability from jvndb - Published: 2025-05-15 07:14 - Updated:2025-05-15 07:14

Severity

9.8 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Pgpool-II vulnerable to authentication bypass by primary weakness

Details

Pgpool-II provided by PgPool Global Development Group contains the following vulnerability.

Authentication bypass by primary weakness (CWE-305) - CVE-2025-46801

PgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development Group coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN06238225/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-46801
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

PgPool Global Development Group

Pgpool-II

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000031.html",
  "dc:date": "2025-05-15T16:14+09:00",
  "dcterms:issued": "2025-05-15T16:14+09:00",
  "dcterms:modified": "2025-05-15T16:14+09:00",
  "description": "Pgpool-II provided by PgPool Global Development Group contains the following vulnerability.\r\n\u003cul\u003e\u003cli\u003eAuthentication bypass by primary weakness (CWE-305) - CVE-2025-46801\u003c/li\u003e\u003c/ul\u003e\r\nPgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development Group coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000031.html",
  "sec:cpe": {
    "#text": "cpe:/a:pgpool:pgpool-ii",
    "@product": "Pgpool-II",
    "@vendor": "PgPool Global Development Group",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "9.8",
    "@severity": "Critical",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000031",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN06238225/index.html",
      "@id": "JVN#06238225",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-46801",
      "@id": "CVE-2025-46801",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Pgpool-II vulnerable to authentication bypass by primary weakness"
}

JVNDB-2024-000096

Vulnerability from jvndb - Published: 2024-09-09 05:58 - Updated:2024-09-09 05:58

Severity

4.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

Pgpool-II vulnerable to information disclosure

Details

Pgpool-II is a cluster management tool. Pgpool-II contains an information disclosure vulnerability (CWE-213) in its query cache function. PgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development Group coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN67456481/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-45624
	Information Exposure(CWE-200)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

PgPool Global Development Group

Pgpool-II

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000096.html",
  "dc:date": "2024-09-09T14:58+09:00",
  "dcterms:issued": "2024-09-09T14:58+09:00",
  "dcterms:modified": "2024-09-09T14:58+09:00",
  "description": "Pgpool-II is a cluster management tool. Pgpool-II contains an information disclosure vulnerability (CWE-213) in its query cache function.\r\n\r\nPgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development Group coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000096.html",
  "sec:cpe": {
    "#text": "cpe:/a:pgpool:pgpool-ii",
    "@product": "Pgpool-II",
    "@vendor": "PgPool Global Development Group",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000096",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN67456481/index.html",
      "@id": "JVN#67456481",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-45624",
      "@id": "CVE-2024-45624",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "Pgpool-II vulnerable to information disclosure"
}

JVNDB-2023-000008

Vulnerability from jvndb - Published: 2023-01-23 07:35 - Updated:2024-06-20 08:54

Severity

5.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

Pgpool-II vulnerable to information disclosure

Details

Pgpool-II is cluster management tool. Pgpool-II contains an information disclosure vulnerability (CWE-200) in its watchdog function. Note that, only systems that meet all of the following setting requirements are affected by this vulnerability.

Watchdog function is enabled (use_watchdog = on)
"query mode" is used for the alive monitoring of watchdog (wd_lifecheck_method = 'query')
Plain text password is set for wd_lifecheck_password

PgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development Group coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	http://jvn.jp/en/jp/JVN72418815/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-22332
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-22332
	Information Exposure(CWE-200)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

PgPool Global Development Group

Pgpool-II

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000008.html",
  "dc:date": "2024-06-20T17:54+09:00",
  "dcterms:issued": "2023-01-23T16:35+09:00",
  "dcterms:modified": "2024-06-20T17:54+09:00",
  "description": "Pgpool-II is cluster management tool. Pgpool-II contains an information disclosure vulnerability (CWE-200) in its watchdog function.\r\nNote that, only systems that meet all of the following setting requirements are affected by this vulnerability.\r\n\u003cul\u003e\r\n\u003cli\u003eWatchdog function is enabled (use_watchdog = on)\r\n\u003cli\u003e\"query mode\" is used for the alive monitoring of watchdog (wd_lifecheck_method = \u0027query\u0027)\r\n\u003cli\u003ePlain text password is set for wd_lifecheck_password\r\n\u003c/ul\u003e\r\nPgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development Group coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000008.html",
  "sec:cpe": {
    "#text": "cpe:/a:pgpool:pgpool-ii",
    "@product": "Pgpool-II",
    "@vendor": "PgPool Global Development Group",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "3.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000008",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN72418815/index.html",
      "@id": "JVN#72418815",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22332",
      "@id": "CVE-2023-22332",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22332",
      "@id": "CVE-2023-22332",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "Pgpool-II vulnerable to information disclosure"
}

JVNDB-2018-000134

Vulnerability from jvndb - Published: 2018-12-21 05:10 - Updated:2019-08-27 08:41

Severity

9.8 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

PgpoolAdmin fails to restrict access permissions

Details

PgpoolAdmin provided by PgPool Global Development Group fails to restrict access permissions (CWE-264). Fotios Rogkotis of DarkMatter reported this vulnerability to PgPool Global Development Group, and PgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development Group coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	http://jvn.jp/en/jp/JVN13199224/index.html
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16203
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2018-16203
	Permissions(CWE-264)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

PgPool Global Development Group

PgpoolAdmin

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000134.html",
  "dc:date": "2019-08-27T17:41+09:00",
  "dcterms:issued": "2018-12-21T14:10+09:00",
  "dcterms:modified": "2019-08-27T17:41+09:00",
  "description": "PgpoolAdmin provided by PgPool Global Development Group fails to restrict access permissions (CWE-264).\r\n\r\nFotios Rogkotis of DarkMatter reported this vulnerability to PgPool Global Development Group, and PgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development Group coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000134.html",
  "sec:cpe": {
    "#text": "cpe:/a:pgpool:pgpooladmin",
    "@product": "PgpoolAdmin",
    "@vendor": "PgPool Global Development Group",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "9.8",
      "@severity": "Critical",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000134",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN13199224/index.html",
      "@id": "JVN#13199224",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16203",
      "@id": "CVE-2018-16203",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-16203",
      "@id": "CVE-2018-16203",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "PgpoolAdmin fails to restrict access permissions"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

27 vulnerabilities by Pgpool Global Development Group

CVE-2026-92873 (GCVE-0-2026-92873)

CVE-2026-92872 (GCVE-0-2026-92872)

CVE-2026-92871 (GCVE-0-2026-92871)

CVE-2026-92870 (GCVE-0-2026-92870)

CVE-2026-92869 (GCVE-0-2026-92869)

CVE-2026-92868 (GCVE-0-2026-92868)

CVE-2026-92867 (GCVE-0-2026-92867)

CVE-2025-46801 (GCVE-0-2025-46801)

CVE-2024-45624 (GCVE-0-2024-45624)

CVE-2023-22332 (GCVE-0-2023-22332)

CVE-2018-16203 (GCVE-0-2018-16203)

CVE-2026-92873 (GCVE-0-2026-92873)

CVE-2026-92872 (GCVE-0-2026-92872)

CVE-2026-92871 (GCVE-0-2026-92871)

CVE-2026-92870 (GCVE-0-2026-92870)

CVE-2026-92869 (GCVE-0-2026-92869)

CVE-2026-92868 (GCVE-0-2026-92868)

CVE-2026-92867 (GCVE-0-2026-92867)

CVE-2025-46801 (GCVE-0-2025-46801)

CVE-2024-45624 (GCVE-0-2024-45624)

CVE-2023-22332 (GCVE-0-2023-22332)

CVE-2018-16203 (GCVE-0-2018-16203)

JVNDB-2026-000140

JVNDB-2025-000031

JVNDB-2024-000096

JVNDB-2023-000008

JVNDB-2018-000134

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

27 vulnerabilities by Pgpool Global Development Group

CVE-2026-92873 (GCVE-0-2026-92873)

CVE-2026-92872 (GCVE-0-2026-92872)

CVE-2026-92871 (GCVE-0-2026-92871)

CVE-2026-92870 (GCVE-0-2026-92870)

CVE-2026-92869 (GCVE-0-2026-92869)

CVE-2026-92868 (GCVE-0-2026-92868)

CVE-2026-92867 (GCVE-0-2026-92867)

CVE-2025-46801 (GCVE-0-2025-46801)

CVE-2024-45624 (GCVE-0-2024-45624)

CVE-2023-22332 (GCVE-0-2023-22332)

CVE-2018-16203 (GCVE-0-2018-16203)

CVE-2026-92873 (GCVE-0-2026-92873)

CVE-2026-92872 (GCVE-0-2026-92872)

CVE-2026-92871 (GCVE-0-2026-92871)

CVE-2026-92870 (GCVE-0-2026-92870)

CVE-2026-92869 (GCVE-0-2026-92869)

CVE-2026-92868 (GCVE-0-2026-92868)

CVE-2026-92867 (GCVE-0-2026-92867)

CVE-2025-46801 (GCVE-0-2025-46801)

CVE-2024-45624 (GCVE-0-2024-45624)

CVE-2023-22332 (GCVE-0-2023-22332)

CVE-2018-16203 (GCVE-0-2018-16203)

JVNDB-2026-000140

JVNDB-2025-000031

JVNDB-2024-000096

JVNDB-2023-000008

JVNDB-2018-000134

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.