CVE-2026-50735: pglogical Buffer Overflow Vulnerability

CVE-2026-50735 Overview

CVE-2026-50735 is an out-of-bounds read vulnerability in pglogical, a logical replication extension for PostgreSQL. The apply worker fails to validate the length of certain fields in incoming replication protocol messages before copying them. A malicious publisher endpoint can return crafted messages that force the subscriber's apply worker to read beyond an allocated buffer. Successful exploitation discloses adjacent process memory or crashes the worker.

The issue is classified under [CWE-125] (Out-of-bounds Read). Exploitation requires an attacker to direct a subscription at an endpoint they control, which normally demands superuser privileges. Managed PostgreSQL deployments that delegate subscription creation to non-superuser roles face the highest exposure.

Critical Impact
A hostile pglogical publisher can leak subscriber process memory or terminate the apply worker, disrupting logical replication and potentially exposing sensitive data held in adjacent memory.

Affected Products

pglogical extension for PostgreSQL (apply worker component)
EnterpriseDB distributions bundling pglogical
Managed PostgreSQL deployments that expose subscription creation to non-superuser roles

Discovery Timeline

2026-07-28 - CVE-2026-50735 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-50735

Vulnerability Analysis

The defect lives in the pglogical apply worker, the subscriber-side process that consumes logical replication messages streamed from a publisher. The apply worker parses protocol messages and copies field data into internal buffers. Length metadata attached to certain fields is trusted without adequate bounds checking. When a message declares a length that exceeds the actual payload or the destination buffer, the copy routine reads past the end of the allocated region.

Two outcomes follow. First, the worker can return adjacent process memory to the attacker through error paths or subsequent replicated content, disclosing arbitrary bytes from the PostgreSQL backend address space. Second, an out-of-bounds access into an unmapped page terminates the worker, halting replication for the affected subscription. Integrity is not directly impacted, since the vulnerability affects reads rather than writes.

Root Cause

The root cause is missing input validation in the replication message parser. Fields carrying length prefixes are copied without confirming that the declared length is consistent with the message frame or the target buffer size. Any attacker-controlled length value larger than the available bytes triggers the over-read.

Attack Vector

Exploitation is remote over the network but requires that the victim's subscription be pointed at an attacker-controlled endpoint speaking the pglogical protocol. The attacker does not need to compromise a legitimate PostgreSQL server. A custom non-PostgreSQL implementation of the wire protocol is sufficient. In stock installations, only superusers can create subscriptions, limiting attack surface. Managed database services that expose CREATE SUBSCRIPTION to lower-privileged roles substantially widen exposure. See the EnterpriseDB Security Advisory for protocol-level detail.

Detection Methods for CVE-2026-50735

Indicators of Compromise

Unexpected termination or repeated restarts of the pglogical apply worker process
PostgreSQL server logs showing SIGSEGV, segmentation fault, or apply worker crash messages tied to logical replication
Subscriptions pointing to hostnames or IP addresses outside the approved replication topology
Replication connections originating from endpoints that do not identify as PostgreSQL servers

Detection Strategies

Audit pg_subscription and pglogical catalog tables for subscription targets that were created by non-superuser roles
Alert on creation or modification of subscriptions from roles other than the designated replication administrator
Correlate apply worker crash events with recent subscription changes to detect exploitation attempts

Monitoring Recommendations

Ship PostgreSQL logs, including replication worker output, to a central SIEM for pattern analysis
Monitor the count and destination of active logical replication connections per database cluster
Track memory footprint and restart frequency of pglogical worker processes as a stability signal

How to Mitigate CVE-2026-50735

Immediate Actions Required

Apply the fixed pglogical release referenced in the EnterpriseDB Security Advisory as soon as it is available for your distribution
Inventory all logical subscriptions and remove any that point to unverified or externally controlled endpoints
Restrict subscription creation privileges to trusted administrative roles until patching is complete

Patch Information

EnterpriseDB has published a security advisory tracking CVE-2026-50735 and lists remediated pglogical builds. Consult the EnterpriseDB Security Advisory for exact versions and upgrade instructions applicable to your PostgreSQL major version and deployment channel.

Workarounds

Revoke the ability to create subscriptions from all non-superuser roles in managed deployments
Enforce network egress controls so that PostgreSQL backends can only reach approved replication publishers
Require TLS with certificate validation on replication connections to prevent redirection to attacker-controlled endpoints
Segment replication traffic onto a dedicated network with strict allow-lists for publisher IP addresses

bash

# Restrict subscription creation to superusers only
REVOKE CREATE ON DATABASE mydb FROM PUBLIC;
REVOKE pg_create_subscription FROM app_admin;

# Verify existing subscription targets
SELECT subname, subconninfo FROM pg_subscription;