Pgpool-II patches authentication and watchdog vulnerabilities

Pgpool-II, which adds pooling, load balancing and failover to PostgreSQL, has issued security updates for five supported release lines. The fixes address malformed watchdog messages, memory corruption and authentication handling. One certificate-processing flaw could let a malicious client authenticate as another user; another issue affected authentication checks when promoting a watchdog node.

Pgpool Global Development Group · Oct 1, 2026

Why it matters

Teams running Pgpool-II should review these fixes independently of their PostgreSQL server version.

More context

Check your Pgpool branch against 4.7.3, 4.6.8, 4.5.13, 4.4.18 or 4.3.21. Review the linked release notes and test failover and certificate authentication in staging before deployment.

Keep in mind

These are released maintenance fixes for Pgpool-II, not a claim that PostgreSQL itself has the same flaws. Exposure depends on configuration; 1min has not tested the patches.

Original read