CVE-2026-50735 EnterpriseDB CVE debrief

Who should care

Users of pglogical extension in PostgreSQL, especially in managed deployments where the ability to create subscriptions has been delegated to non-superuser roles, should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing and applying the vendor advisory, restricting access to subscription creation, and monitoring for suspicious subscription activities. Additionally, users should ensure that they are running a version of pglogical that has been patched to address this issue.

Technical summary

The pglogical extension in PostgreSQL is vulnerable to an out-of-bounds read. The apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them. This can cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, potentially disclosing adjacent process memory or crashing the worker. The issue can be exploited by a party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol.

Defensive priority

This vulnerability allows an attacker to cause an out-of-bounds read, potentially disclosing adjacent process memory or crashing the worker. To exploit the issue, an attacker must be able to direct a subscription at an endpoint they control, which in default installations requires privileges normally reserved for a superuser.

Recommended defensive actions

• Review and apply the vendor advisory for CVE-2026-50735
• Restrict access to subscription creation to trusted roles
• Monitor for suspicious subscription activities
• Update to pglogical version 2.4.8 or later
• Perform a thorough review of the system for any signs of compromise
• Implement additional monitoring to detect potential attacks
• Conduct a security audit to identify potential vulnerabilities

Evidence notes

The vulnerability exists in pglogical's apply worker, which does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them. This results in an out-of-bounds read when a party acting as the publisher for a subscription returns crafted messages. The issue can be mitigated by restricting access to subscription creation to trusted roles and monitoring for suspicious subscription activities. Evidence is limited to CVE and NVD details.

Official resources