Denial of Service Vulnerability in PocketBase by Pocketbase
CVE-2026-82410
8.7HIGH
What is CVE-2026-82410?
PocketBase, an open-source web backend written in Go, has a vulnerability that affects its panic-recovery middleware. Prior to versions 0.22.48 and 0.39.7, this middleware does not handle panics occurring in internal child and worker goroutines. If a panic occurs in one of these internal processes, it can escape the recovery mechanism, potentially leading to a denial of service by terminating the server process. The recent updates include a new routine called SafeWrap, designed to convert recovered panics into regular errors, thereby enhancing stability and resilience against unexpected errors in internal operations.
Affected Version(s)
pocketbase < 0.22.48 < 0.22.48
pocketbase >= 0.23.0, < 0.39.7 < 0.23.0, 0.39.7