CVE-2026-50738

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a low-privileged user able to influence worker start, stop, and restart timing through permitted pglogical operations. In the typical case the condition crashes replication workers, causing an availability impact. In the worst case a use-after-free in a PostgreSQL backend can be leveraged as a remote code execution primitive at the privilege of that backend.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.enterprisedb.com/docs/security/advisories/cve202650738/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:enterprisedb:pglogical:*:*:*:*:*:postgresql:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una condición de uso después de liberación existe en el código de señalización de trabajadores de pglogical, donde una estructura de trabajador puede ser desreferenciada después de que el slot subyacente haya sido liberado o reciclado durante eventos normales del ciclo de vida del trabajador. La condición es alcanzable durante la operación normal de replicación, incluso por un usuario con pocos privilegios capaz de influir en el inicio, detención y reinicio de los trabajadores a través de operaciones pglogical permitidas. En el caso típico, la condición provoca la caída de los trabajadores de replicación, causando un impacto en la disponibilidad. En el peor de los casos, un uso después de liberación en un backend de PostgreSQL puede ser aprovechado como una primitiva de ejecución remota de código con los privilegios de ese backend.

Information

Published : 2026-07-28 19:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-50738

Mitre link : CVE-2026-50738

CVE.ORG link : CVE-2026-50738

JSON object : View

Products Affected

enterprisedb

pglogical

CWE

CWE-416

Use After Free

{"id": "CVE-2026-50738", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50738", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-28T18:44:48.974347Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "affectedData": [{"vendor": "EnterpriseDB", "product": "pglogical", "versions": [{"status": "affected", "version": "2", "lessThan": "2.4.8", "versionType": "semver"}], "defaultStatus": "affected"}]}], "published": "2026-07-28T19:17:36.967", "references": [{"url": "https://www.enterprisedb.com/docs/security/advisories/cve202650738/", "tags": ["Vendor Advisory"], "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a low-privileged user able to influence worker start, stop, and restart timing through permitted pglogical operations. In the typical case the condition crashes replication workers, causing an availability impact. In the worst case a use-after-free in a PostgreSQL backend can be leveraged as a remote code execution primitive at the privilege of that backend."}, {"lang": "es", "value": "Una condici\u00f3n de uso despu\u00e9s de liberaci\u00f3n existe en el c\u00f3digo de se\u00f1alizaci\u00f3n de trabajadores de pglogical, donde una estructura de trabajador puede ser desreferenciada despu\u00e9s de que el slot subyacente haya sido liberado o reciclado durante eventos normales del ciclo de vida del trabajador. La condici\u00f3n es alcanzable durante la operaci\u00f3n normal de replicaci\u00f3n, incluso por un usuario con pocos privilegios capaz de influir en el inicio, detenci\u00f3n y reinicio de los trabajadores a trav\u00e9s de operaciones pglogical permitidas. En el caso t\u00edpico, la condici\u00f3n provoca la ca\u00edda de los trabajadores de replicaci\u00f3n, causando un impacto en la disponibilidad. En el peor de los casos, un uso despu\u00e9s de liberaci\u00f3n en un backend de PostgreSQL puede ser aprovechado como una primitiva de ejecuci\u00f3n remota de c\u00f3digo con los privilegios de ese backend."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:enterprisedb:pglogical:*:*:*:*:*:postgresql:*:*", "vulnerable": true, "matchCriteriaId": "DC0E75E2-2571-4AB8-892A-DA7B88B722EF", "versionEndExcluding": "2.4.8", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "20be33e2-bf35-4d13-8fad-18bd2f3e3659"}