Read the docs
TI-2026-37398 Aliases CVE-2026-50735GHSA-jhwv-w4qj-9cmf

Out-of-bounds read in EnterpriseDB pglogical

Priority LOW 27CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00376 31st percentileScored 2026-11-07
Fix Fixed pglogical (EnterpriseDB): 2.4.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EnterpriseDBpglogical2 to before 2.4.82.4.8Patch availableCNA
  • pglogical VendorEnterpriseDB Affected 2 to before 2.4.8 Fixed in 2.4.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:enterprisedb:pglogical:*:*:*:*:*:postgresql:*:*2.0.0 to before 2.4.8VulnerableEnterpriseDB
  • cpe:2.3:a:enterprisedb:pglogical:*:*:*:*:*:postgresql:*:* Versions 2.0.0 to before 2.4.8 Vulnerable ·EnterpriseDB

Remediation

  • Fix · CNA pglogical (EnterpriseDB) Fixed in 2.4.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    EnterpriseDB pglogical 2.4.8

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-37400 When applying replicated changes for a row that is missing one or more columns, pglogical…Priority MEDIUM 41
    • TI-2026-37399 SQL injection in EnterpriseDB pglogicalPriority MEDIUM 41
    • TI-2026-37401 Use after free in EnterpriseDB pglogicalPriority LOW 36
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50735
  2. 2026-10-03 Alias added: GHSA-jhwv-w4qj-9cmf

References

Advisory 1

  • TI-2026-37400 When applying replicated changes for a row that is missing one or more columns, pglogical… CVSS 4.0CRITICAL 9.0
  • TI-2026-37399 SQL injection in EnterpriseDB pglogical CVSS 4.0CRITICAL 9.0
  • TI-2026-37401 Use after free in EnterpriseDB pglogical CVSS 4.0HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences