EnterpriseDB pglogical up to 2.4.7 Apply Worker out-of-bounds

Summaryinfo

A vulnerability labeled as problematic has been found in EnterpriseDB pglogical up to 2.4.7. Impacted is an unknown function of the component Apply Worker. Such manipulation leads to out-of-bounds. This vulnerability is referenced as CVE-2026-50735. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in EnterpriseDB pglogical up to 2.4.7. Affected by this issue is an unknown part of the component Apply Worker. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.

The advisory is shared for download at enterprisedb.com. This vulnerability is handled as CVE-2026-50735 since 06/05/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation requires an enhanced level of successful authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 2.4.8 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• EnterpriseDB

Name

• pglogical

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.4.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion