Executive brief
pglogical is a tool used for replicating data between PostgreSQL databases. A vulnerability in its replication worker allows a malicious or compromised data source to send specially crafted messages that can crash the receiving database or expose sensitive information from its memory. While typically requiring high-level administrative access to set up, this issue is particularly significant for managed database environments where lower-level users might be granted permission to configure data subscriptions.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the pglogical apply worker due to insufficient validation of field lengths in incoming replication protocol messages. An attacker acting as a replication publisher can send crafted messages that cause the subscriber's apply worker to read beyond allocated buffer bounds. This can lead to the disclosure of adjacent process memory or a denial-of-service condition via worker crashes. Exploitation requires the attacker to control a replication endpoint and have the privileges necessary to direct a subscription to that endpoint (typically superuser, or delegated subscription roles in managed environments). The issue is fixed in pglogical version 2.4.8.
Affected products
- EnterpriseDB pglogical 2.x before 2.4.8
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory