Pgpool-II fixes client certificate validation bypass in CVE-2026-92868

Pgpool Global Development Group released fixes for seven Pgpool-II vulnerabilities (JVN#22475874). The headline flaw, CVE-2026-92868 (CWE-295, CVSS 6.9/6.5), allows client certificate authentication bypass; affected branches span 3.5.x to 4.7.2, with fixes in 4.7.3, 4.6.8, 4.5.13, 4.4.18 and 4.3.21.

• CVE-2026-92868: client certificate validation bypass, CVSS 6.9 (v4) and 6.5 (v3)
• Seven CVEs in one advisory, four of them memory safety issues
• CVE-2026-92867: out-of-bounds write with code execution, CVSS 8.7
• Branches 3.5.x–4.2.x are unsupported and need a branch upgrade