CVE-2026-82410 json
Pocketbase: Unhandled panic in worker goroutines
published last mo. modified last mo. also EUVD-2026-80831 , GHSA-84vh-m24q-wjjx , GO-2026-6489
- cvss
- 8.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service. The remediation introduces routine.SafeWrap to convert recovered panics into regular errors and applies it to the affected internal worker functions. This issue is fixed in versions 0.22.48 and 0.39.7.
Patch / fix
- go github.com/pocketbase/pocketbase 0.22.48, 0.39.7
- pocketbase pocketbase 0.22.48, 0.39.7
Is CVE-2026-82410 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last mo.
Exploit prediction
0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/pocketbase/pocketbase | <0.22.48 >=0.23.0, <0.39.7 |
0.22.48 0.39.7 |
Affected products
- pocketbase pocketbase
Classification
- Weakness
-
- CWE-248 Uncaught Exception
References
-
github.com
/pocketbase/pocketbase/commit/30b4184305904fae0d1b78216c4e3cc34700b220
web, patch
-
github.com
/pocketbase/pocketbase/commit/f1618ee59b6d1c0308bb474c827a2b1f24b12a95
web, patch
-
github.com
/pocketbase/pocketbase/security/advisories/GHSA-84vh-m24q-wjjx
web, advisory
-
github.com
/pocketbase/pocketbase/discussions/7762
web
-
github.com
/pocketbase/pocketbase/releases/tag/v0.22.48
web
-
github.com
/pocketbase/pocketbase/releases/tag/v0.39.7
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-82410
advisory
-
github.com
/pocketbase/pocketbase
package
Sources
- CVE List CVE-2026-82410
- GitHub Advisory GHSA-84vh-m24q-wjjx
- NVD CVE-2026-82410
- OSV GO-2026-6489
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.