PatchTheCVEpglogical vulnerabilities and fixes
Recent CVEs affecting pglogical, with upgrade or downgrade steps. 4 tracked.
pglogical has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-07-28. Highest priority: CVE-2026-50736 (score 35/100).
- CVE-2026-50736 HIGH 7.5 UPGRADE The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to
- CVE-2026-50737 HIGH 7.5 UPGRADE When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affect
- CVE-2026-50735 MEDIUM 6.8 UPGRADE pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication p
- CVE-2026-50738 MEDIUM 5.3 UPGRADE A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be derefe
FAQ
How do I fix pglogical vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pglogical being exploited right now?
None of the tracked pglogical CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pglogical CVE should I patch first?
CVE-2026-50736 currently ranks highest (35/100): The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to .