An unauthenticated attacker can cause a denial of service in Pocketbase by triggering a panic in internal worker goroutines that the application fails to recover.

This vulnerability is an uncaught exception (CWE-248) where internal goroutines escape the main panic-recovery middleware. An unauthenticated attacker can exploit this to terminate the server process, resulting in a total denial of service.

The potential for a denial of service attack poses a significant risk to service availability and business continuity. With a CVSS score of 8.7, this vulnerability is classified as high severity, as it allows remote, unauthenticated actors to disrupt core backend operations without requiring any special privileges or user interaction.

Immediate Action: Upgrade to Pocketbase version 0.22.48 or 0.39.7 immediately to incorporate the necessary panic recovery logic.

Proactive Monitoring: Monitor server health metrics for sudden process restarts or unexpected application crashes that correlate with anomalous traffic patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious requests, and ensure that the backend service is configured to auto-restart upon failure to minimize downtime.

Public Exploit Available: No

Given the ease of exploitation and the critical impact on service availability, organizations should prioritize patching their Pocketbase instances to the specified fixed versions. Failure to address this vulnerability leaves the backend infrastructure susceptible to disruption by any remote, unauthenticated attacker.