Threats tagged 'ghsa-jhwv-w4qj-9cmf'

A vulnerability in pglogical's apply worker allows insufficient validation of field lengths in replication protocol messages, leading to out-of-bounds reads. An attacker controlling the publisher endpoint can exploit this to disclose adjacent process memory or crash the apply worker. Exploitation requires directing a subscription to a malicious endpoint, which typically requires superuser privileges, making this issue more relevant in managed environments where subscription creation is delegated to non-superusers.