Login Request a demo
Critical severity · published May 19, 2025
CVE-2025-46801
Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PG
Pgpool-II · PgPool Global Development Group
4.6.0; 4.5.0 to 4.5.6; 4.4.0 to 4.4.11; 4.3.0 to 4.3.14; 4.2.0 to 4.2.21; All versions of 4.1 series; +1 more · source: vendor
Affected product
PG
Pgpool-II
PgPool Global Development Group
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-46801
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-46801
jvn.jp
https://jvn.jp/en/jp/JVN06238225/
www.pgpool.net
https://www.pgpool.net/mediawiki/index.php/Main_Page#News
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/10/msg00014.html
More from Pgpool-II
8.8
CVE-2026-92867
An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution
7.5
CVE-2026-92871
A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process
7.5
CVE-2026-92870
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination
7.3
CVE-2026-92873
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node
6.5
CVE-2026-92869
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination