CVE-2026-82410 in PocketBase
Summary
by MITRE • 09/17/2026
Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service. The remediation introduces routine.SafeWrap to convert recovered panics into regular errors and applies it to the affected internal worker functions. This issue is fixed in versions 0.22.48 and 0.39.7.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in PocketBase, a popular open-source backend framework written in Go, stems from an incomplete implementation of panic recovery mechanisms within the application's internal architecture. Prior to versions 0.22.48 and 0.39.7, the software utilized middleware designed to handle panics that occur during standard HTTP request processing. This middleware effectively catches unexpected exceptions thrown by handlers responsible for serving external client requests, thereby preventing a single malformed or maliciously crafted request from crashing the entire server instance. However, this protective layer was not extended to cover internal child goroutines and background worker processes. These internal routines are critical for maintaining application state, managing database connections, processing asynchronous tasks, and handling other backend operations that do not directly correspond to incoming HTTP requests but are essential for the system's overall stability and functionality.
The technical flaw lies in the fact that Go applications typically rely on deferred functions with recover() calls to intercept panics and prevent process termination. While the request-handling middleware correctly implemented this pattern, internal worker goroutines operated without equivalent safeguards. When a panic occurs within one of these unprotected internal routines, it propagates up the call stack until it reaches the top level of that specific goroutine's execution context. Since there is no recover mechanism in place for these background tasks, the Go runtime treats the unrecovered panic as a fatal error and immediately terminates the entire server process. This behavior transforms what might otherwise be an isolated internal logic error into a catastrophic system failure, effectively allowing any condition that triggers such a panic to result in a complete service outage.
The operational impact of this vulnerability is significant, primarily manifesting as a denial of service against PocketBase deployments. An attacker or even a legitimate user triggering specific edge cases could cause the application to crash repeatedly if they can induce conditions leading to panics within these internal workers. This includes scenarios involving malformed data processing, race conditions in concurrent operations, or resource exhaustion issues that trigger runtime errors like index out-of-bounds or nil pointer dereferences within background tasks. The resulting instability undermines the reliability and availability of services relying on PocketBase as their backend infrastructure. For production environments where high uptime is critical, this lack of resilience against internal failures poses a substantial risk to business continuity and user experience.
To address this issue, the remediation strategy involves introducing a utility function named routine.SafeWrap which encapsulates panic recovery logic specifically for background operations. This wrapper converts recovered panics into regular error objects that can be logged or handled gracefully rather than allowing them to terminate the process. By applying SafeWrap to all affected internal worker functions and child goroutines, developers ensure that unexpected exceptions are contained within their respective execution contexts. The fix has been released in versions 0.22.48 and 0.39.7 of PocketBase. Organizations using earlier versions should upgrade immediately to mitigate the risk of denial-of-service attacks stemming from internal panics. Additionally, implementing comprehensive logging for recovered errors will aid in identifying underlying code defects that lead to these conditions, further enhancing long-term system stability. This vulnerability aligns with CWE-248 Unhandled Exception and reflects a gap consistent with ATT&CK techniques related to resource exhaustion or service disruption through application-level failures.