CVE-2026-82410

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82410

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82410.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82410

Aliases

GHSA-84vh-m24q-wjjx

Published

2026-09-16T14:59:19Z

Modified

2026-09-18T03:48:31Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Pocketbase: Unhandled panic in worker goroutines

Details

Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service. The remediation introduces routine.SafeWrap to convert recovered panics into regular errors and applies it to the affected internal worker functions. This issue is fixed in versions 0.22.48 and 0.39.7.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-248"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82410.json"
}

References

Affected packages

Git / github.com/pocketbase/pocketbase

Affected ranges

Type

GIT

Repo

https://github.com/pocketbase/pocketbase

Events

Introduced

d5dddf3eadaffadc73503c464f6ff8ac6450a874

Fixed

794f1d5a8e4e400d4b8a2f8d15a29cba79ddc0d6

Fixed

636b7e28d8ffd3829f501f28f3725facf62a4042

Fixed

30b4184305904fae0d1b78216c4e3cc34700b220

Fixed

f1618ee59b6d1c0308bb474c827a2b1f24b12a95

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.22.48"
        },
        {
            "introduced":  "0.23.0"
        },
        {
            "fixed":  "0.39.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.14.1

v0.14.2

v0.15.0

v0.16.0

v0.16.1

v0.17.0

v0.17.1

v0.17.2

v0.17.3

v0.17.4

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.18.4

v0.18.5

v0.18.6

v0.19.0

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.20.0

v0.20.0-rc

v0.20.0-rc2

v0.20.0-rc3

v0.20.1

v0.21.0

v0.21.1

v0.22.1

v0.22.12

v0.22.13

v0.22.14

v0.22.14-rc

v0.22.15

v0.22.16

v0.22.17

v0.22.18

v0.22.19

v0.22.2

v0.22.20

v0.22.21

v0.22.22

v0.22.23

v0.22.24

v0.22.25

v0.22.26

v0.22.27

v0.22.28

v0.22.29

v0.22.3

v0.22.30

v0.22.31

v0.22.32

v0.22.33

v0.22.34

v0.22.35

v0.22.36

v0.22.37

v0.22.38

v0.22.39

v0.22.4

v0.22.40

v0.22.41

v0.22.42

v0.22.43

v0.22.44

v0.22.45

v0.22.46

v0.22.47

v0.22.5

v0.22.6

v0.22.7

v0.22.8

v0.22.9

v0.23.0

v0.23.1

v0.23.2

v0.23.3

v0.23.4

v0.24.0

v0.24.1

v0.24.2

v0.24.3

v0.24.4

v0.25.0

v0.26.0

v0.26.0-rc.1

v0.26.1

v0.27.0

v0.28.0

v0.28.1

v0.28.2

v0.28.3

v0.28.4

v0.29.0

v0.29.1

v0.29.2

v0.29.3

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.30.0

v0.30.1

v0.30.2

v0.30.3

v0.30.4

v0.31.0

v0.32.0

v0.33.0

v0.34.0

v0.34.1

v0.34.2

v0.35.0

v0.35.1

v0.36.0

v0.36.0-rc.1

v0.36.1

v0.36.2

v0.36.3

v0.36.4

v0.36.5

v0.36.6

v0.36.7

v0.36.7-rc.1

v0.36.8

v0.36.9

v0.37.0

v0.37.1

v0.37.2

v0.37.3

v0.37.4

v0.37.5

v0.38.0

v0.38.1

v0.38.2

v0.39.0

v0.39.1

v0.39.2

v0.39.3

v0.39.4

v0.39.5

v0.39.6

v0.4.0

v0.4.1

v0.4.2

v0.5.0

v0.6.0

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.8.0

v0.8.0-rc1

v0.8.0-rc2

v0.8.0-rc3

v0.8.0-rc4

v0.9.0

v0.9.1

v0.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82410.json"