CVE-2026-92867

Отчет

This vulnerability is rated as Important severity because an authenticated remote attacker can exploit memory corruption in the Pgpool-II daemon to execute arbitrary code or trigger an abnormal process crash. Exploitation requires established authentication credentials against the pooler, which limits exposure by preventing unauthenticated remote attacks. Pgpool-II is not shipped in supported Red Hat Enterprise Linux releases, restricting the impact primarily to community environments such as Fedora.

Меры по смягчению последствий

Disable the Pgpool-II service if it is not required in your environment:

1. Stop and disable the service:

systemctl stop pgpool

systemctl disable pgpool

Alternatively, if the service must remain operational, restrict network access to trusted database clients using firewalld: 2. Allow access only from trusted IP addresses or subnets:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_ip_or_subnet>" port port="9999" protocol="tcp" accept'

3. Ensure general access to the service port is removed:

firewall-cmd --permanent --remove-port=9999/tcp

4. Apply the changes:

firewall-cmd --reload

Caveats: Stopping the service disables PostgreSQL connection pooling and load balancing capabilities. Restricting network access with firewall rules will block any legitimate clients connecting from unlisted IP addresses. Warning: Stopping the pgpool service or reloading firewall configurations will disconnect existing client database connections and disrupt service availability until clients reconnect.