{"cve":"CVE-2026-82410","nvd":{"published":"2026-09-16T15:17:54.703","modified":"2026-09-30T17:51:56.193","status":"Deferred","description":"Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service. The remediation introduces routine.SafeWrap to convert recovered panics into regular errors and applies it to the affected internal worker functions. This issue is fixed in versions 0.22.48 and 0.39.7.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":null,"cwes":["CWE-248"],"references":["https://github.com/pocketbase/pocketbase/commit/30b4184305904fae0d1b78216c4e3cc34700b220","https://github.com/pocketbase/pocketbase/commit/f1618ee59b6d1c0308bb474c827a2b1f24b12a95","https://github.com/pocketbase/pocketbase/discussions/7762","https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48","https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:54:41.405518556+00:00"},"epss":{"cve":"CVE-2026-82410","score":0.00577,"percentile":0.4725,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-84vh-m24q-wjjx","url":"https://osv.dev/vulnerability/GHSA-84vh-m24q-wjjx","summary":"Pocketbase: Unhandled panic in worker goroutines","modified":"2026-10-07T17:55:49.811253981Z","packages":[{"ecosystem":"Go","name":"github.com/pocketbase/pocketbase","purl":"pkg:golang/github.com/pocketbase/pocketbase","ranges":["<0.22.48"],"fixed":["0.22.48"]},{"ecosystem":"Go","name":"github.com/pocketbase/pocketbase","purl":"pkg:golang/github.com/pocketbase/pocketbase","ranges":[">=0.23.0 <0.39.7"],"fixed":["0.39.7"]}]},{"id":"GO-2026-6489","url":"https://osv.dev/vulnerability/GO-2026-6489","summary":"Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase","modified":"2026-10-07T17:45:12.818270704Z","packages":[{"ecosystem":"Go","name":"github.com/pocketbase/pocketbase","purl":"pkg:golang/github.com/pocketbase/pocketbase","ranges":["<0.22.48",">=0.23.0 <0.39.7"],"fixed":["0.22.48","0.39.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}