Read the docs
TI-2026-37401 Aliases CVE-2026-50738GHSA-7pcx-4vjw-f9pr

Use after free in EnterpriseDB pglogical

Priority LOW 36CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a low-privileged user able to influence worker start, stop, and restart timing through permitted pglogical operations. In the typical case the condition crashes replication workers, causing an availability impact. In the worst case a use-after-free in a PostgreSQL backend can be leveraged as a remote code execution primitive at the privilege of that backend.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00508 43rd percentileScored 2026-11-07
Fix Fixed pglogical (EnterpriseDB): 2.4.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EnterpriseDBpglogical2 to before 2.4.82.4.8Patch availableCNA
  • pglogical VendorEnterpriseDB Affected 2 to before 2.4.8 Fixed in 2.4.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:enterprisedb:pglogical:*:*:*:*:*:postgresql:*:*2.0.0 to before 2.4.8VulnerableEnterpriseDB
  • cpe:2.3:a:enterprisedb:pglogical:*:*:*:*:*:postgresql:*:* Versions 2.0.0 to before 2.4.8 Vulnerable ·EnterpriseDB

Remediation

  • Fix · CNA pglogical (EnterpriseDB) Fixed in 2.4.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    EnterpriseDB pglogical 2.4.8

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-37400 When applying replicated changes for a row that is missing one or more columns, pglogical…Priority MEDIUM 41
    • TI-2026-37399 SQL injection in EnterpriseDB pglogicalPriority MEDIUM 41
    • TI-2026-37398 Out-of-bounds read in EnterpriseDB pglogicalPriority LOW 27
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50738
  2. 2026-10-03 Alias added: GHSA-7pcx-4vjw-f9pr

References

Advisory 1

  • TI-2026-37400 When applying replicated changes for a row that is missing one or more columns, pglogical… CVSS 4.0CRITICAL 9.0
  • TI-2026-37399 SQL injection in EnterpriseDB pglogical CVSS 4.0CRITICAL 9.0
  • TI-2026-37398 Out-of-bounds read in EnterpriseDB pglogical CVSS 4.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences