Detections
Analytics

Echo: pglogical: security update to 2.4.8

medium Tenable Self-Hosted Container Security Plugin ID 459098

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - pglogical's apply worker does not sufficiently validate the length of certain fields in incoming
 replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as
 the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical
 replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond
 the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit
 the issue an attacker must be able to direct a subscription at an endpoint they control. In default
 installations this requires privileges normally reserved for a superuser, so the issue is most relevant to
 managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
 (CVE-2026-50735)

Solution

Update the pglogical library and its related packages to version 2.4.8 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-50735

Plugin Details

Severity: Medium

ID: 459098

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.51

CVSS v2

Risk Factor: Medium

Base Score: 6.6

Temporal Score: 4.9

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:N/A:C

CVSS Score Source: CVE-2026-50735

CVSS v3

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.1

Threat Score: 2.4

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/29/2026

Vulnerability Publication Date: 7/28/2026

Reference Information

CVE: CVE-2026-50735