CVE-2026-82410: Pocketbase: Unhandled panic in worker goroutines
Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service. The remediation introduces routine.SafeWrap to convert recovered panics into regular errors and applies it to the affected internal worker functions. This issue is fixed in versions 0.22.48 and 0.39.7.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketBaseto a version that resolves this vulnerability.Fixed in 0.22.48 - Upgrade
Upgrade
PocketBaseto a version that resolves this vulnerability.Fixed in 0.39.7
Event History
Frequently Asked Questions
Which deployments are affected?
PocketBase deployments running versions earlier than 0.22.48 or 0.39.7 are affected. The issue concerns internal child and worker goroutines that are not covered by the regular request panic-recovery middleware.
What does an attacker need to do to cause impact?
An attacker must trigger a panic in an affected internal child or worker goroutine. If that panic escapes recovery, it can terminate the PocketBase server process and cause denial of service.
Is a configuration change needed to be exposed?
The provided information does not identify any configuration prerequisite. The vulnerable behavior is in PocketBase's handling of internal worker goroutines rather than regular request handling.
What should be done if immediate patching is not possible?
No workaround or mitigation is provided. Upgrade to 0.22.48 or 0.39.7 when possible; these versions apply routine.SafeWrap to affected internal worker functions so recovered panics become regular errors.