CVE-2026-50735

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50735", "assignerOrgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "state": "PUBLISHED", "assignerShortName": "EDB", "dateReserved": "2026-06-05T19:13:51.103Z", "datePublished": "2026-07-28T17:55:12.049Z", "dateUpdated": "2026-11-12T19:08:46.842Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "shortName": "EDB", "dateUpdated": "2026-11-12T19:08:46.842Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "type": "CWE"}]}], "affected": [{"vendor": "EnterpriseDB", "product": "pglogical", "versions": [{"version": "2", "status": "affected", "lessThan": "2.4.8", "versionType": "semver"}], "defaultStatus": "affected"}, {"vendor": "pgEdge", "product": "Spock", "repo": "https://github.com/pgEdge/spock", "versions": [{"version": "3", "status": "affected", "lessThanOrEqual": "3.3.6", "versionType": "custom"}, {"version": "3.3.7", "status": "unaffected", "versionType": "custom"}, {"version": "4", "status": "affected", "lessThanOrEqual": "4.1.0.3", "versionType": "custom"}, {"version": "4.1.1", "status": "unaffected", "versionType": "custom"}, {"version": "5", "status": "affected", "lessThanOrEqual": "5.0.11", "versionType": "custom"}, {"version": "5.0.12", "status": "unaffected", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Mehmet Ince (@mdisec)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "references": [{"url": "https://www.enterprisedb.com/docs/security/advisories/cve202650735/"}, {"url": "https://github.com/pgEdge/spock/security/advisories/GHSA-j2m3-f88h-2h46", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T18:58:57.167071Z", "id": "CVE-2026-50735", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T19:02:17.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50735", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T18:58:57.167071Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T19:01:38.663Z"}}], "cna": {"source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Mehmet Ince (@mdisec)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "EnterpriseDB", "product": "pglogical", "versions": [{"status": "affected", "version": "2", "lessThan": "2.4.8", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.enterprisedb.com/docs/security/advisories/cve202650735/"}], "descriptions": [{"lang": "en", "value": "pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "shortName": "EDB", "dateUpdated": "2026-07-28T17:55:12.049Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50735", "state": "PUBLISHED", "dateUpdated": "2026-07-28T19:02:17.182Z", "dateReserved": "2026-06-05T19:13:51.103Z", "assignerOrgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "datePublished": "2026-07-28T17:55:12.049Z", "assignerShortName": "EDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "pglogical", "vendor": "EnterpriseDB", "versions": [{"lessThan": "2.4.8", "status": "affected", "version": "2", "versionType": "semver"}]}, {"defaultStatus": "unknown", "product": "Spock", "repo": "https://github.com/pgEdge/spock", "vendor": "pgEdge", "versions": [{"lessThanOrEqual": "3.3.6", "status": "affected", "version": "3", "versionType": "custom"}, {"status": "unaffected", "version": "3.3.7", "versionType": "custom"}, {"lessThanOrEqual": "4.1.0.3", "status": "affected", "version": "4", "versionType": "custom"}, {"status": "unaffected", "version": "4.1.1", "versionType": "custom"}, {"lessThanOrEqual": "5.0.11", "status": "affected", "version": "5", "versionType": "custom"}, {"status": "unaffected", "version": "5.0.12", "versionType": "custom"}]}], "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:enterprisedb:pglogical:*:*:*:*:*:postgresql:*:*", "matchCriteriaId": "DC0E75E2-2571-4AB8-892A-DA7B88B722EF", "versionEndExcluding": "2.4.8", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles."}, {"lang": "es", "value": "El worker de aplicaci\u00f3n de pglogical no valida suficientemente la longitud de ciertos campos en los mensajes entrantes del protocolo de replicaci\u00f3n antes de copiarlos, lo que resulta en una lectura fuera de l\u00edmites. Una parte que act\u00faa como publicador para una suscripci\u00f3n, por ejemplo, un endpoint que no es PostgreSQL y que habla el protocolo de replicaci\u00f3n pglogical, puede devolver mensajes manipulados que hacen que el worker de aplicaci\u00f3n del suscriptor lea m\u00e1s all\u00e1 de los l\u00edmites de un b\u00fafer asignado, revelando memoria de proceso adyacente o bloqueando el worker. Para explotar el problema, un atacante debe ser capaz de dirigir una suscripci\u00f3n a un endpoint que controlan. En instalaciones predeterminadas, esto requiere privilegios normalmente reservados para un superusuario, por lo que el problema es m\u00e1s relevante para implementaciones gestionadas donde la capacidad de crear suscripciones ha sido delegada a roles que no son de superusuario."}], "id": "CVE-2026-50735", "lastModified": "2026-11-12T19:17:04.430", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50735", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T18:58:57.167071Z", "version": "2.0.3"}}]}, "published": "2026-07-28T19:17:36.540", "references": [{"source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "url": "https://github.com/pgEdge/spock/security/advisories/GHSA-j2m3-f88h-2h46"}, {"source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "tags": ["Vendor Advisory"], "url": "https://www.enterprisedb.com/docs/security/advisories/cve202650735/"}], "sourceIdentifier": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2,2.4.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pglogical", "source": "cna", "vendor": "EnterpriseDB"}, "product": "pglogical", "vendor": "enterprisedb"}], "created": "2026-07-28T20:33:56.706627+00:00", "updated": "2026-08-03T14:45:04.293490+00:00", "vendors": ["enterprisedb", "enterprisedb$PRODUCT$pglogical"]}