by Kastro
Paper/Archive/CVE-2025-46801

CVE-2025-46801

PgPool Global Development Group Pgpool-II — Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability.

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.1.601 × 2012.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database.

Affected

ProductAffectedFixed inSource
Pgpool-II4.6.0–CNA
Pgpool-II4.5.0 to 4.5.6–CNA
Pgpool-II4.4.0 to 4.4.11–CNA
Pgpool-II4.3.0 to 4.3.14–CNA
Pgpool-II4.2.0 to 4.2.21–CNA
Pgpool-IIAll versions of 4.1 series–CNA
Pgpool-IIAll versions of 4.0 series–CNA

Scores by source

jpcert (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
jpcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refpgpool.net/mediawiki/index.php/Main_Page#Newsrefjvn.jp/en/jp/JVN06238225reflists.debian.org/debian-lts-announce/2025/10/msg00014.html