CVE-2026-50735
Received Received - Intake

Out-of-Bounds Read in pglogical Apply Worker

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: EnterpriseDB Corporation

Description
pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-50735
EUVD
EUVD-2026-49935

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
2ndquadrant pglogical *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves pglogical's apply worker failing to validate the length of certain fields in replication protocol messages. This leads to an out-of-bounds read, where crafted messages from a malicious publisher can cause the subscriber's worker to read beyond allocated memory, potentially disclosing process memory or crashing the worker.

Detection Guidance

Detection requires monitoring for crashes in the pglogical apply worker process or unusual memory access patterns. Check PostgreSQL logs for worker crashes or segmentation faults. No specific commands are provided in the context.

Impact Analysis

An attacker who controls a publisher endpoint could exploit this to crash the pglogical apply worker on the subscriber side or leak sensitive memory contents. Exploitation requires the ability to create subscriptions, which is typically restricted to superusers in default setups.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive data through memory disclosure or causing service disruptions. The out-of-bounds read may allow unauthorized access to process memory, which could include personal or protected health information. However, exploitation requires specific conditions, such as control over a subscription endpoint, limiting the direct impact on compliance.

Mitigation Strategies

Restrict subscription creation privileges to superusers only. Avoid delegating subscription creation to non-superuser roles. Update pglogical to the latest patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50735. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart