pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pglogical's apply worker does not sufficiently validate the length of certain fields in incoming
    replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as
    the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical
    replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond
    the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit
    the issue an attacker must be able to direct a subscription at an endpoint they control. In default
    installations this requires privileges normally reserved for a superuser, so the issue is most relevant to
    managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
    (CVE-2026-50735)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pglogical's apply worker does not sufficiently validate the length of certain fields in incoming     replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as     the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical     replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond     the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit     the issue an attacker must be able to direct a subscription at an endpoint they control. In default     installations this requires privileges normally reserved for a superuser, so the issue is most relevant to     managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
    (CVE-2026-50735)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459098	Echo: pglogical: security update to 2.4.8	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459098	Echo: pglogical: security update to 2.4.8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
330648	Linux Distros Unpatched Vulnerability : CVE-2026-50735	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-50735

medium

Tenable Plugins

medium

medium

medium