{"id":"CVE-2026-82410","kind":"vulnerability","aliases":["CVE-2026-82410","GHSA-84vh-m24q-wjjx","GO-2026-6489"],"related":[],"title":"Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase","description":"Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service. The remediation introduces routine.SafeWrap to convert recovered panics into regular errors and applies it to the affected internal worker functions. This issue is fixed in versions 0.22.48 and 0.39.7.","summary":"PocketBase's panic recovery does not cover its internal child and worker goroutines, so a panic there crashes the whole server process. An attacker who can trigger such a panic can take the backend offline (denial of service).","severity":"high","cvss":8.7,"epss":0.00577,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/pocketbase/pocketbase","fixed":["0.22.48","0.39.7"],"affected":">= 0.23.0, < 0.39.7","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","pocketbase","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"grep pocketbase go.mod to see the pinned version; versions below 0.22.48 (0.22 line) or below 0.39.7 are affected per the description","fix":"Upgrade to 0.22.48 (0.22 line) or 0.39.7 (0.39 line), which add routine.SafeWrap around the affected worker functions.","status":"open","published_at":"2026-09-16T15:17:54+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:44:01+00:00","updated_at":"2026-10-23T21:44:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:44:01Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 0.22.48 (0.22 line) or 0.39.7 (0.39 line), which add routine.SafeWrap around the affected worker functions.","reach":"unknown","impact":"medium","summary":"PocketBase's panic recovery does not cover its internal child and worker goroutines, so a panic there crashes the whole server process. An attacker who can trigger such a panic can take the backend offline (denial of service).","category":"package","who_cares":["go","pocketbase","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server process crashes, causing denial of service until restarted.","analyst_note":"Affected range in products (>=0.23.0, <0.39.7) conflicts with the description (prior to 0.22.48 and 0.39.7); check the GHSA-84vh-m24q-wjjx advisory and which trigger reaches the worker goroutines.","how_to_check":"grep pocketbase go.mod to see the pinned version; versions below 0.22.48 (0.22 line) or below 0.39.7 are affected per the description\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000942,"input_tokens":3011,"output_tokens":1281,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A,23A '-6489':21A '-82410':13A,24A '/pocketbase/pocketbase':10A,27A '0.22.48':84C,151C '0.39.7':86C,153C '84vh':16A 'affect':141C 'appli':137C 'attack':57B 'backend':67B,78C 'caus':120C 'child':43B,100C 'convert':130C 'cover':40B,93C 'crash':51B 'cve':11A,22A 'denial':69B,122C 'error':135C 'escap':113C 'fix':148C 'function':144C 'ghsa':15A 'ghsa-84vh-m24q-wjjx':14A 'github.com':9A,26A 'github.com/pocketbase/pocketbase':8A,25A 'go':19A,28B,81C 'goroutin':6A,46B,103C,111C 'handl':96C 'host':33B 'intern':42B,99C,110C,142C 'introduc':127C 'issu':146C 'm24q':17A 'middlewar':92C 'offlin':68B 'one':107C 'open':75C 'packag':29B 'panic':3A,36B,49B,63B,90C,105C,132C 'panic-recoveri':89C 'pocketbas':1A,30B,34B,72C,87C 'prior':82C 'process':55B,119C 'recov':131C 'recoveri':37B,91C,114C 'regular':94C,134C 'remedi':126C 'request':95C 'routine.safewrap':128C 'self':32B 'self-host':31B 'server':54B,118C 'servic':71B,124C 'sourc':76C 'take':65B 'termin':116C 'trigger':60B 'unhandl':2A 'version':150C 'web':77C 'whole':53B 'wjjx':18A 'worker':5A,45B,102C,143C 'written':79C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T15:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6489","url":"https://pkg.go.dev/vuln/GO-2026-6489","severity":null,"published_at":"2026-10-07T14:10:35+00:00","modified_at":"2026-10-07T14:10:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-82410","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82410","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-82410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82410","severity":null,"published_at":"2026-09-16T15:17:54+00:00","modified_at":"2026-09-30T17:51:56+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}