Search
Find a vulnerability
Search criteria
5 vulnerabilities
CVE-2026-111438 (GCVE-0-2026-111438)
Vulnerability from cvelistv5 – Published: 2026-10-19 08:08 – Updated: 2026-10-19 17:22
VLAI
EPSS
VEX
Title
check_hba_replication 认证与访问控制绕过
Summary
在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远程 trust 禁止等完整校验。因此，非内部网络的 HADR/SW 复制连接可绕过内部连接限制和完整 pg_hba 策略完成认证，进而通过复制协议读取备份与日志数据。
此问题随 HADR 复制发送方绕过内部连接校验进入代码，自 3.0.0 起即存在。受影响版本包括 3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS版本修复，通过要求 HADR/SW 复制发送方必须经过 is_node_internal_connection 校验，使外部复制连接改走普通 check_hba() 并触发禁止远程 trust 策略。修复pr见https://gitcode.com/opengauss/openGauss-server/pull/9757。
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:22 UTC
CWE
- CWE-288 - Authentication bypass using an alternate path or channel
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openGauss-server | openGauss-server |
Unaffected:
7.0.0-LTS
Affected: 3.0.0-3.0.5 Affected: 3.1.0-3.1.1 Affected: 5.0.0-RC1 Affected: 5.0.0-5.0.3 Affected: 6.0.0-RC1 Affected: 6.0.0-6.0.6 Affected: 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111438",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:22:00.742739Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:22:23.532Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0%20(LTS)",
"defaultStatus": "unaffected",
"platforms": [
"openEuler",
"Centos"
],
"product": "openGauss-server",
"vendor": "openGauss-server",
"versions": [
{
"status": "unaffected",
"version": "7.0.0-LTS"
},
{
"status": "affected",
"version": "3.0.0-3.0.5"
},
{
"status": "affected",
"version": "3.1.0-3.1.1"
},
{
"status": "affected",
"version": "5.0.0-RC1"
},
{
"status": "affected",
"version": "5.0.0-5.0.3"
},
{
"status": "affected",
"version": "6.0.0-RC1"
},
{
"status": "affected",
"version": "6.0.0-6.0.6"
},
{
"status": "affected",
"version": "7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u5728 openGauss-server \u7684 src/common/backend/libpq/hba.cpp \u4e2d\uff0c\u590d\u5236\u8fde\u63a5\u8ba4\u8bc1\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u7ed5\u8fc7\u3002hba_getauthmethod() \u5728\u5904\u7406 HADR/SW \u590d\u5236\u53d1\u9001\u65b9\u65f6\uff0c\u4e0d\u8981\u6c42 is_node_internal_connection()\uff0c\u76f4\u63a5\u8c03\u7528 check_hba_replication()\u3002check_hba_replication() \u4ec5\u6309 replication \u6807\u8bb0\u505a\u5f31\u5339\u914d\uff0c\u7f3a\u5c11\u666e\u901a check_hba() \u4e2d\u7684\u8fdc\u7a0b trust \u7981\u6b62\u7b49\u5b8c\u6574\u6821\u9a8c\u3002\u56e0\u6b64\uff0c\u975e\u5185\u90e8\u7f51\u7edc\u7684 HADR/SW \u590d\u5236\u8fde\u63a5\u53ef\u7ed5\u8fc7\u5185\u90e8\u8fde\u63a5\u9650\u5236\u548c\u5b8c\u6574 pg_hba \u7b56\u7565\u5b8c\u6210\u8ba4\u8bc1\uff0c\u8fdb\u800c\u901a\u8fc7\u590d\u5236\u534f\u8bae\u8bfb\u53d6\u5907\u4efd\u4e0e\u65e5\u5fd7\u6570\u636e\u3002\u003cbr\u003e\u003cbr\u003e\u6b64\u95ee\u9898\u968f HADR \u590d\u5236\u53d1\u9001\u65b9\u7ed5\u8fc7\u5185\u90e8\u8fde\u63a5\u6821\u9a8c\u8fdb\u5165\u4ee3\u7801\uff0c\u81ea 3.0.0 \u8d77\u5373\u5b58\u5728\u3002\u53d7\u5f71\u54cd\u7248\u672c\u5305\u62ec 3.0.x\u30013.1.x\u30015.0.x\u30015.1.0\u30016.0.x\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\u3002\u8be5\u95ee\u9898\u5df2\u5728 7.0.0-LTS\u7248\u672c\u4fee\u590d\uff0c\u901a\u8fc7\u8981\u6c42 HADR/SW \u590d\u5236\u53d1\u9001\u65b9\u5fc5\u987b\u7ecf\u8fc7 is_node_internal_connection \u6821\u9a8c\uff0c\u4f7f\u5916\u90e8\u590d\u5236\u8fde\u63a5\u6539\u8d70\u666e\u901a check_hba() \u5e76\u89e6\u53d1\u7981\u6b62\u8fdc\u7a0b trust \u7b56\u7565\u3002\u4fee\u590dpr\u89c1https://gitcode.com/opengauss/openGauss-server/pull/9757\u3002\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "\u5728 openGauss-server \u7684 src/common/backend/libpq/hba.cpp \u4e2d\uff0c\u590d\u5236\u8fde\u63a5\u8ba4\u8bc1\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u7ed5\u8fc7\u3002hba_getauthmethod() \u5728\u5904\u7406 HADR/SW \u590d\u5236\u53d1\u9001\u65b9\u65f6\uff0c\u4e0d\u8981\u6c42 is_node_internal_connection()\uff0c\u76f4\u63a5\u8c03\u7528 check_hba_replication()\u3002check_hba_replication() \u4ec5\u6309 replication \u6807\u8bb0\u505a\u5f31\u5339\u914d\uff0c\u7f3a\u5c11\u666e\u901a check_hba() \u4e2d\u7684\u8fdc\u7a0b trust \u7981\u6b62\u7b49\u5b8c\u6574\u6821\u9a8c\u3002\u56e0\u6b64\uff0c\u975e\u5185\u90e8\u7f51\u7edc\u7684 HADR/SW \u590d\u5236\u8fde\u63a5\u53ef\u7ed5\u8fc7\u5185\u90e8\u8fde\u63a5\u9650\u5236\u548c\u5b8c\u6574 pg_hba \u7b56\u7565\u5b8c\u6210\u8ba4\u8bc1\uff0c\u8fdb\u800c\u901a\u8fc7\u590d\u5236\u534f\u8bae\u8bfb\u53d6\u5907\u4efd\u4e0e\u65e5\u5fd7\u6570\u636e\u3002\n\n\u6b64\u95ee\u9898\u968f HADR \u590d\u5236\u53d1\u9001\u65b9\u7ed5\u8fc7\u5185\u90e8\u8fde\u63a5\u6821\u9a8c\u8fdb\u5165\u4ee3\u7801\uff0c\u81ea 3.0.0 \u8d77\u5373\u5b58\u5728\u3002\u53d7\u5f71\u54cd\u7248\u672c\u5305\u62ec 3.0.x\u30013.1.x\u30015.0.x\u30015.1.0\u30016.0.x\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\u3002\u8be5\u95ee\u9898\u5df2\u5728 7.0.0-LTS\u7248\u672c\u4fee\u590d\uff0c\u901a\u8fc7\u8981\u6c42 HADR/SW \u590d\u5236\u53d1\u9001\u65b9\u5fc5\u987b\u7ecf\u8fc7 is_node_internal_connection \u6821\u9a8c\uff0c\u4f7f\u5916\u90e8\u590d\u5236\u8fde\u63a5\u6539\u8d70\u666e\u901a check_hba() \u5e76\u89e6\u53d1\u7981\u6b62\u8fdc\u7a0b trust \u7b56\u7565\u3002\u4fee\u590dpr\u89c1https://gitcode.com/opengauss/openGauss-server/pull/9757\u3002"
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:08:03.265Z",
"orgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"shortName": "openGauss"
},
"references": [
{
"url": "https://gitcode.com/opengauss/openGauss-server/pull/9757"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "check_hba_replication \u8ba4\u8bc1\u4e0e\u8bbf\u95ee\u63a7\u5236\u7ed5\u8fc7",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"assignerShortName": "openGauss",
"cveId": "CVE-2026-111438",
"datePublished": "2026-10-19T08:08:03.265Z",
"dateReserved": "2026-10-16T03:04:53.420Z",
"dateUpdated": "2026-10-19T17:22:23.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111439 (GCVE-0-2026-111439)
Vulnerability from cvelistv5 – Published: 2026-10-19 07:59 – Updated: 2026-10-19 17:25
VLAI
EPSS
VEX
Title
pg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块
Summary
在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 is_row_data_file() 也仅用于识别文件形态，未包含权限检查。因此，任何拥有普通数据库连接权限的用户，只要能够通过 pg_relation_filepath() 等函数获取到目标表的底层关系文件路径（例如压缩数据的 _compress 文件路径），即可无需具备该表的 SELECT 权限，直接读取表数据的二进制块。
此漏洞影响此前3.0.0到6.0.0间的所有版本及补丁版，并在7.0.0-LTS版本修复。修复patch详见：https://gitcode.com/opengauss/openGauss-server/pull/9374。
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:24 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openGauss-server | openGauss-server |
Unaffected:
7.0.0-LTS
Affected: 3.0.0-3.0.5 Affected: 3.1.0-3.1.1 Affected: 5.0.0-RC1 Affected: 5.0.0-5.0.3 Affected: 5.1.0 Affected: 6.0.0-RC1 Affected: 6.0.0-6.0.6 Affected: 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111439",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:24:53.483125Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:25:07.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0%20(LTS)",
"defaultStatus": "unaffected",
"platforms": [
"openEuler Centos"
],
"product": "openGauss-server",
"vendor": "openGauss-server",
"versions": [
{
"status": "unaffected",
"version": "7.0.0-LTS"
},
{
"status": "affected",
"version": "3.0.0-3.0.5"
},
{
"status": "affected",
"version": "3.1.0-3.1.1"
},
{
"status": "affected",
"version": "5.0.0-RC1"
},
{
"status": "affected",
"version": "5.0.0-5.0.3"
},
{
"status": "affected",
"version": "5.1.0"
},
{
"status": "affected",
"version": "6.0.0-RC1"
},
{
"status": "affected",
"version": "6.0.0-6.0.6"
},
{
"status": "affected",
"version": "7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u5728 openGauss-server\u7684 src/common/backend/utils/adt/genfile.cpp \u6a21\u5757\u4e2d\uff0c\u5185\u7f6e\u51fd\u6570 pg_read_binary_file_blocks() \u5b58\u5728\u6743\u9650\u6821\u9a8c\u903b\u8f91\u7f3a\u9677\u3002\u8be5\u51fd\u6570\u5728\u5165\u53e3\u5904\u4ec5\u6821\u9a8c\u4e86\u8d77\u59cb\u5757\u53f7\uff08startBlockNum\uff09\u548c\u5757\u6570\u91cf\uff08blockCount\uff09\u7684\u8303\u56f4\uff0c\u968f\u540e\u76f4\u63a5\u8c03\u7528\u5e95\u5c42\u6587\u4ef6\u8bfb\u53d6\u4f8b\u7a0b ReadBinaryFileBlocksFirstCall()\u3002\u8be5\u5e95\u5c42\u4f8b\u7a0b\u4ec5\u6267\u884c\u4e86\u8def\u5f84\u89c4\u8303\u5316\u68c0\u67e5\u4ee5\u53ca\u9488\u5bf9 .. \u8def\u5f84\u904d\u5386\u548c\u6570\u636e\u76ee\u5f55\u8fb9\u754c\u7684\u57fa\u672c\u68c0\u67e5\uff0c\u7f3a\u5931\u4e86\u5bf9\u8c03\u7528\u8005\u6570\u636e\u5e93\u6743\u9650\uff08\u5982 SELECT \u6743\u9650\uff09\u7684\u6821\u9a8c\u3002\u6b64\u5916\uff0c\u8f85\u52a9\u51fd\u6570 is_row_data_file() \u4e5f\u4ec5\u7528\u4e8e\u8bc6\u522b\u6587\u4ef6\u5f62\u6001\uff0c\u672a\u5305\u542b\u6743\u9650\u68c0\u67e5\u3002\u56e0\u6b64\uff0c\u4efb\u4f55\u62e5\u6709\u666e\u901a\u6570\u636e\u5e93\u8fde\u63a5\u6743\u9650\u7684\u7528\u6237\uff0c\u53ea\u8981\u80fd\u591f\u901a\u8fc7 pg_relation_filepath() \u7b49\u51fd\u6570\u83b7\u53d6\u5230\u76ee\u6807\u8868\u7684\u5e95\u5c42\u5173\u7cfb\u6587\u4ef6\u8def\u5f84\uff08\u4f8b\u5982\u538b\u7f29\u6570\u636e\u7684 _compress \u6587\u4ef6\u8def\u5f84\uff09\uff0c\u5373\u53ef\u65e0\u9700\u5177\u5907\u8be5\u8868\u7684 SELECT \u6743\u9650\uff0c\u76f4\u63a5\u8bfb\u53d6\u8868\u6570\u636e\u7684\u4e8c\u8fdb\u5236\u5757\u3002\u003cbr\u003e\u6b64\u6f0f\u6d1e\u5f71\u54cd\u6b64\u524d3.0.0\u52306.0.0\u95f4\u7684\u6240\u6709\u7248\u672c\u53ca\u8865\u4e01\u7248\uff0c\u5e76\u57287.0.0-LTS\u7248\u672c\u4fee\u590d\u3002\u4fee\u590dpatch\u8be6\u89c1\uff1ahttps://gitcode.com/opengauss/openGauss-server/pull/9374\u3002"
}
],
"value": "\u5728 openGauss-server\u7684 src/common/backend/utils/adt/genfile.cpp \u6a21\u5757\u4e2d\uff0c\u5185\u7f6e\u51fd\u6570 pg_read_binary_file_blocks() \u5b58\u5728\u6743\u9650\u6821\u9a8c\u903b\u8f91\u7f3a\u9677\u3002\u8be5\u51fd\u6570\u5728\u5165\u53e3\u5904\u4ec5\u6821\u9a8c\u4e86\u8d77\u59cb\u5757\u53f7\uff08startBlockNum\uff09\u548c\u5757\u6570\u91cf\uff08blockCount\uff09\u7684\u8303\u56f4\uff0c\u968f\u540e\u76f4\u63a5\u8c03\u7528\u5e95\u5c42\u6587\u4ef6\u8bfb\u53d6\u4f8b\u7a0b ReadBinaryFileBlocksFirstCall()\u3002\u8be5\u5e95\u5c42\u4f8b\u7a0b\u4ec5\u6267\u884c\u4e86\u8def\u5f84\u89c4\u8303\u5316\u68c0\u67e5\u4ee5\u53ca\u9488\u5bf9 .. \u8def\u5f84\u904d\u5386\u548c\u6570\u636e\u76ee\u5f55\u8fb9\u754c\u7684\u57fa\u672c\u68c0\u67e5\uff0c\u7f3a\u5931\u4e86\u5bf9\u8c03\u7528\u8005\u6570\u636e\u5e93\u6743\u9650\uff08\u5982 SELECT \u6743\u9650\uff09\u7684\u6821\u9a8c\u3002\u6b64\u5916\uff0c\u8f85\u52a9\u51fd\u6570 is_row_data_file() \u4e5f\u4ec5\u7528\u4e8e\u8bc6\u522b\u6587\u4ef6\u5f62\u6001\uff0c\u672a\u5305\u542b\u6743\u9650\u68c0\u67e5\u3002\u56e0\u6b64\uff0c\u4efb\u4f55\u62e5\u6709\u666e\u901a\u6570\u636e\u5e93\u8fde\u63a5\u6743\u9650\u7684\u7528\u6237\uff0c\u53ea\u8981\u80fd\u591f\u901a\u8fc7 pg_relation_filepath() \u7b49\u51fd\u6570\u83b7\u53d6\u5230\u76ee\u6807\u8868\u7684\u5e95\u5c42\u5173\u7cfb\u6587\u4ef6\u8def\u5f84\uff08\u4f8b\u5982\u538b\u7f29\u6570\u636e\u7684 _compress \u6587\u4ef6\u8def\u5f84\uff09\uff0c\u5373\u53ef\u65e0\u9700\u5177\u5907\u8be5\u8868\u7684 SELECT \u6743\u9650\uff0c\u76f4\u63a5\u8bfb\u53d6\u8868\u6570\u636e\u7684\u4e8c\u8fdb\u5236\u5757\u3002\n\u6b64\u6f0f\u6d1e\u5f71\u54cd\u6b64\u524d3.0.0\u52306.0.0\u95f4\u7684\u6240\u6709\u7248\u672c\u53ca\u8865\u4e01\u7248\uff0c\u5e76\u57287.0.0-LTS\u7248\u672c\u4fee\u590d\u3002\u4fee\u590dpatch\u8be6\u89c1\uff1ahttps://gitcode.com/opengauss/openGauss-server/pull/9374\u3002"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T07:59:44.700Z",
"orgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"shortName": "openGauss"
},
"references": [
{
"url": "https://gitcode.com/opengauss/openGauss-server/pull/9374"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "pg_read_binary_file_blocks \u7f3a\u5c11\u521d\u59cb\u7528\u6237\u6743\u9650\u6821\u9a8c\uff0c\u666e\u901a\u7528\u6237\u53ef\u8bfb\u53d6 relation \u6587\u4ef6\u5757",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"assignerShortName": "openGauss",
"cveId": "CVE-2026-111439",
"datePublished": "2026-10-19T07:59:44.700Z",
"dateReserved": "2026-10-16T03:04:55.778Z",
"dateUpdated": "2026-10-19T17:25:07.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111440 (GCVE-0-2026-111440)
Vulnerability from cvelistv5 – Published: 2026-10-19 03:55 – Updated: 2026-10-19 17:39
VLAI
EPSS
VEX
Title
JDBC LogFactory 任意类加载/构造导致潜在 RCE
Summary
在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。
此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:39 UTC
CWE
- CWE-470 - Use of Externally-Controlled input to select classes or code ('unsafe reflection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openGauss-server | openGauss-connector-jdbc |
Unaffected:
7.0.0-LTS
Affected: 1.0.0, 1.0.1, 1.1.0 Affected: 2.0.0, 2.1.0 Affected: 3.0.0-3.0.5 Affected: 3.1.0-3.1.1 Affected: 5.0.0-5.0.3 Affected: 5.1.0 Affected: 5.0.0-RC1 Affected: 6.0.0-RC1 Affected: 6.0.0-6.0.6 Affected: 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:39:30.858779Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:39:59.272Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0-RC3",
"defaultStatus": "unaffected",
"platforms": [
"openEuler",
"Centos"
],
"product": "openGauss-connector-jdbc",
"vendor": "openGauss-server",
"versions": [
{
"status": "unaffected",
"version": "7.0.0-LTS"
},
{
"status": "affected",
"version": "1.0.0, 1.0.1, 1.1.0"
},
{
"status": "affected",
"version": "2.0.0, 2.1.0"
},
{
"status": "affected",
"version": "3.0.0-3.0.5"
},
{
"status": "affected",
"version": "3.1.0-3.1.1"
},
{
"status": "affected",
"version": "5.0.0-5.0.3"
},
{
"status": "affected",
"version": "5.1.0"
},
{
"status": "affected",
"version": "5.0.0-RC1"
},
{
"status": "affected",
"version": "6.0.0-RC1"
},
{
"status": "affected",
"version": "6.0.0-6.0.6"
},
{
"status": "affected",
"version": "7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u5728 openGauss-connector-jdbc \u7684 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java \u4e2d\uff0cLogFactory \u6839\u636e JDBC \u8fde\u63a5\u53c2\u6570\u4e2d\u7684 logger \u7c7b\u540d\u8c03\u7528 Class.forName \u52a0\u8f7d\u7c7b\u540e\uff0c\u76f4\u63a5\u53cd\u5c04\u8c03\u7528\u4ee5 String \u4e3a\u53c2\u6570\u7684\u6784\u9020\u51fd\u6570\uff0c\u518d\u8f6c\u6362\u4e3a Log\u3002\u7f3a\u5c11 asSubclass(Log.class) \u6821\u9a8c\uff0c\u975e Log \u5b9e\u73b0\u7c7b\u4e5f\u4f1a\u5728\u7c7b\u578b\u68c0\u67e5\u524d\u88ab\u5b9e\u4f8b\u5316\u3002\u56e0\u6b64\uff0c\u5f53\u653b\u51fb\u8005\u53ef\u63a7\u5236 JDBC URL \u6216\u8fde\u63a5\u5c5e\u6027\u4e2d\u7684 logger \u7c7b\u540d\uff0c\u4e14\u5ba2\u6237\u7aef classpath \u4e2d\u5b58\u5728\u53ef\u88ab\u52a0\u8f7d\u7684\u7c7b\u65f6\uff0c\u53ef\u80fd\u5728\u5ba2\u6237\u7aef\u89e6\u53d1\u975e\u9884\u671f\u7684\u7c7b\u52a0\u8f7d\u4e0e\u6784\u9020\u526f\u4f5c\u7528\u3002\u003cbr\u003e\u003cbr\u003e\u6b64\u6f0f\u6d1e\u81ea JDBC 1.1.0\u5f15\u5165\uff0c\u5f71\u54cd 1.1.0 \u53ca\u4e4b\u540e\u7684 2.x\u30013.x\u30015.x\u30016.x \u5404\u7248\u672c\u53ca\u8865\u4e01\uff08\u542b 6.0.0 \u5206\u652f\u6700\u65b0 6.0.6\uff09\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\uff0c\u5e76\u5728 7.0.0-LTS \u7248\u672c\u4fee\u590d\u3002\u4fee\u590d\u5728 Class.forName \u4e4b\u540e\u5148\u6267\u884c asSubclass(Log.class)\uff0c\u4ec5\u5141\u8bb8 Log \u5b50\u7c7b\u8fdb\u5165\u6784\u9020\u3002\u4fee\u590dpr\u89c1https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423\u3002"
}
],
"value": "\u5728 openGauss-connector-jdbc \u7684 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java \u4e2d\uff0cLogFactory \u6839\u636e JDBC \u8fde\u63a5\u53c2\u6570\u4e2d\u7684 logger \u7c7b\u540d\u8c03\u7528 Class.forName \u52a0\u8f7d\u7c7b\u540e\uff0c\u76f4\u63a5\u53cd\u5c04\u8c03\u7528\u4ee5 String \u4e3a\u53c2\u6570\u7684\u6784\u9020\u51fd\u6570\uff0c\u518d\u8f6c\u6362\u4e3a Log\u3002\u7f3a\u5c11 asSubclass(Log.class) \u6821\u9a8c\uff0c\u975e Log \u5b9e\u73b0\u7c7b\u4e5f\u4f1a\u5728\u7c7b\u578b\u68c0\u67e5\u524d\u88ab\u5b9e\u4f8b\u5316\u3002\u56e0\u6b64\uff0c\u5f53\u653b\u51fb\u8005\u53ef\u63a7\u5236 JDBC URL \u6216\u8fde\u63a5\u5c5e\u6027\u4e2d\u7684 logger \u7c7b\u540d\uff0c\u4e14\u5ba2\u6237\u7aef classpath \u4e2d\u5b58\u5728\u53ef\u88ab\u52a0\u8f7d\u7684\u7c7b\u65f6\uff0c\u53ef\u80fd\u5728\u5ba2\u6237\u7aef\u89e6\u53d1\u975e\u9884\u671f\u7684\u7c7b\u52a0\u8f7d\u4e0e\u6784\u9020\u526f\u4f5c\u7528\u3002\n\n\u6b64\u6f0f\u6d1e\u81ea JDBC 1.1.0\u5f15\u5165\uff0c\u5f71\u54cd 1.1.0 \u53ca\u4e4b\u540e\u7684 2.x\u30013.x\u30015.x\u30016.x \u5404\u7248\u672c\u53ca\u8865\u4e01\uff08\u542b 6.0.0 \u5206\u652f\u6700\u65b0 6.0.6\uff09\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\uff0c\u5e76\u5728 7.0.0-LTS \u7248\u672c\u4fee\u590d\u3002\u4fee\u590d\u5728 Class.forName \u4e4b\u540e\u5148\u6267\u884c asSubclass(Log.class)\uff0c\u4ec5\u5141\u8bb8 Log \u5b50\u7c7b\u8fdb\u5165\u6784\u9020\u3002\u4fee\u590dpr\u89c1https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423\u3002"
}
],
"impacts": [
{
"capecId": "CAPEC-138",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-138 Reflection Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470 Use of Externally-Controlled input to select classes or code (\u0027unsafe reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:12:17.254Z",
"orgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"shortName": "openGauss"
},
"references": [
{
"url": "https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "JDBC LogFactory \u4efb\u610f\u7c7b\u52a0\u8f7d/\u6784\u9020\u5bfc\u81f4\u6f5c\u5728 RCE",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"assignerShortName": "openGauss",
"cveId": "CVE-2026-111440",
"datePublished": "2026-10-19T03:55:19.107Z",
"dateReserved": "2026-10-16T03:04:57.224Z",
"dateUpdated": "2026-10-19T17:39:59.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111441 (GCVE-0-2026-111441)
Vulnerability from cvelistv5 – Published: 2026-10-19 02:31 – Updated: 2026-10-19 17:42
VLAI
EPSS
VEX
Title
HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写
Summary
在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的 lenTotal，导致安全拷贝无法拦截越界写。hll_in()、hll_print()、hll_cardinality() 等 SQL 入口会走同一解包路径。因此，普通数据库连接用户只需构造 lenTotal 小于 lenUsed 的畸形 packed HLL（例如经 ::hll 进入 hll_in()），即可触发服务端堆越界写，存在内存破坏风险。此问题随 packed HLL 解包函数 HllObjectUnpack() 进入代码，v2.1.0 起即存在。受影响版本包括 2.1.0、3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS 版本修复，通过在 HllObjectUnpack() 中补齐 lenUsed <= lenTotal 校验，并将 memcpy_s() 的目标大小改为实际分配的 lenTotal。修复 PR 见 https://gitcode.com/opengauss/openGauss-server/pull/9380 。
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:42 UTC
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| openGauss-server | openGauss-server |
Unaffected:
7.0.0-LTS
|
|
| openGauss-server | openGauss-server |
Affected:
7.0.0-RC1, 7.0.0-RC2 7.0.0-RC3
Affected: 2.1.0 Affected: 3.0.0-3.0.6 Affected: 3.1.0 Affected: 5.0.0-5.0.5 Affected: 6.0.0-6.0.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:42:18.566832Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:42:42.026Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0%20(LTS)",
"defaultStatus": "unaffected",
"platforms": [
"openEuler Centos"
],
"product": "openGauss-server",
"vendor": "openGauss-server",
"versions": [
{
"status": "unaffected",
"version": "7.0.0-LTS"
}
]
},
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0-RC3",
"defaultStatus": "unaffected",
"platforms": [
"openEuler Centos"
],
"product": "openGauss-server",
"vendor": "openGauss-server",
"versions": [
{
"status": "affected",
"version": "7.0.0-RC1, 7.0.0-RC2 7.0.0-RC3"
},
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "3.0.0-3.0.6"
},
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "5.0.0-5.0.5"
},
{
"status": "affected",
"version": "6.0.0-6.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u5728 openGauss-server \u7684 src/gausskernel/cbb/utils/hll/hll.cpp \u4e2d\uff0c\u5185\u7f6e\u51fd\u6570 HllObjectUnpack() \u5b58\u5728\u957f\u5ea6\u6821\u9a8c\u7f3a\u9677\u3002\u8be5\u51fd\u6570\u4ece\u7528\u6237\u63d0\u4f9b\u7684 packed HLL \u89e3\u6790 lenUsed \u4e0e lenTotal \u540e\uff0c\u4ec5\u68c0\u67e5\u8f93\u5165\u957f\u5ea6\u8db3\u4ee5\u8986\u76d6 HLL_HEAD_SIZE + lenUsed\uff0c\u968f\u540e\u6309 lenTotal \u5206\u914d\u7f13\u51b2\u533a\u3001\u6309 lenUsed \u8c03\u7528 memcpy_s() \u62f7\u8d1d\u8f93\u5165\uff0c\u65e2\u672a\u6821\u9a8c lenTotal \u0026gt;= lenUsed\uff0c\u4e5f\u5c06 memcpy_s() \u76ee\u6807\u5927\u5c0f\u5199\u6210 lenUsed \u800c\u975e\u5b9e\u9645\u5206\u914d\u7684 lenTotal\uff0c\u5bfc\u81f4\u5b89\u5168\u62f7\u8d1d\u65e0\u6cd5\u62e6\u622a\u8d8a\u754c\u5199\u3002hll_in()\u3001hll_print()\u3001hll_cardinality() \u7b49 SQL \u5165\u53e3\u4f1a\u8d70\u540c\u4e00\u89e3\u5305\u8def\u5f84\u3002\u56e0\u6b64\uff0c\u666e\u901a\u6570\u636e\u5e93\u8fde\u63a5\u7528\u6237\u53ea\u9700\u6784\u9020 lenTotal \u5c0f\u4e8e lenUsed \u7684\u7578\u5f62 packed HLL\uff08\u4f8b\u5982\u7ecf ::hll \u8fdb\u5165 hll_in()\uff09\uff0c\u5373\u53ef\u89e6\u53d1\u670d\u52a1\u7aef\u5806\u8d8a\u754c\u5199\uff0c\u5b58\u5728\u5185\u5b58\u7834\u574f\u98ce\u9669\u3002\u6b64\u95ee\u9898\u968f packed HLL \u89e3\u5305\u51fd\u6570 HllObjectUnpack() \u8fdb\u5165\u4ee3\u7801\uff0cv2.1.0 \u8d77\u5373\u5b58\u5728\u3002\u53d7\u5f71\u54cd\u7248\u672c\u5305\u62ec 2.1.0\u30013.0.x\u30013.1.x\u30015.0.x\u30015.1.0\u30016.0.x\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\u3002\u8be5\u95ee\u9898\u5df2\u5728 7.0.0-LTS \u7248\u672c\u4fee\u590d\uff0c\u901a\u8fc7\u5728 HllObjectUnpack() \u4e2d\u8865\u9f50 lenUsed \u0026lt;= lenTotal \u6821\u9a8c\uff0c\u5e76\u5c06 memcpy_s() \u7684\u76ee\u6807\u5927\u5c0f\u6539\u4e3a\u5b9e\u9645\u5206\u914d\u7684 lenTotal\u3002\u4fee\u590d PR \u89c1 https://gitcode.com/opengauss/openGauss-server/pull/9380 \u3002\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "\u5728 openGauss-server \u7684 src/gausskernel/cbb/utils/hll/hll.cpp \u4e2d\uff0c\u5185\u7f6e\u51fd\u6570 HllObjectUnpack() \u5b58\u5728\u957f\u5ea6\u6821\u9a8c\u7f3a\u9677\u3002\u8be5\u51fd\u6570\u4ece\u7528\u6237\u63d0\u4f9b\u7684 packed HLL \u89e3\u6790 lenUsed \u4e0e lenTotal \u540e\uff0c\u4ec5\u68c0\u67e5\u8f93\u5165\u957f\u5ea6\u8db3\u4ee5\u8986\u76d6 HLL_HEAD_SIZE + lenUsed\uff0c\u968f\u540e\u6309 lenTotal \u5206\u914d\u7f13\u51b2\u533a\u3001\u6309 lenUsed \u8c03\u7528 memcpy_s() \u62f7\u8d1d\u8f93\u5165\uff0c\u65e2\u672a\u6821\u9a8c lenTotal \u003e= lenUsed\uff0c\u4e5f\u5c06 memcpy_s() \u76ee\u6807\u5927\u5c0f\u5199\u6210 lenUsed \u800c\u975e\u5b9e\u9645\u5206\u914d\u7684 lenTotal\uff0c\u5bfc\u81f4\u5b89\u5168\u62f7\u8d1d\u65e0\u6cd5\u62e6\u622a\u8d8a\u754c\u5199\u3002hll_in()\u3001hll_print()\u3001hll_cardinality() \u7b49 SQL \u5165\u53e3\u4f1a\u8d70\u540c\u4e00\u89e3\u5305\u8def\u5f84\u3002\u56e0\u6b64\uff0c\u666e\u901a\u6570\u636e\u5e93\u8fde\u63a5\u7528\u6237\u53ea\u9700\u6784\u9020 lenTotal \u5c0f\u4e8e lenUsed \u7684\u7578\u5f62 packed HLL\uff08\u4f8b\u5982\u7ecf ::hll \u8fdb\u5165 hll_in()\uff09\uff0c\u5373\u53ef\u89e6\u53d1\u670d\u52a1\u7aef\u5806\u8d8a\u754c\u5199\uff0c\u5b58\u5728\u5185\u5b58\u7834\u574f\u98ce\u9669\u3002\u6b64\u95ee\u9898\u968f packed HLL \u89e3\u5305\u51fd\u6570 HllObjectUnpack() \u8fdb\u5165\u4ee3\u7801\uff0cv2.1.0 \u8d77\u5373\u5b58\u5728\u3002\u53d7\u5f71\u54cd\u7248\u672c\u5305\u62ec 2.1.0\u30013.0.x\u30013.1.x\u30015.0.x\u30015.1.0\u30016.0.x\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\u3002\u8be5\u95ee\u9898\u5df2\u5728 7.0.0-LTS \u7248\u672c\u4fee\u590d\uff0c\u901a\u8fc7\u5728 HllObjectUnpack() \u4e2d\u8865\u9f50 lenUsed \u003c= lenTotal \u6821\u9a8c\uff0c\u5e76\u5c06 memcpy_s() \u7684\u76ee\u6807\u5927\u5c0f\u6539\u4e3a\u5b9e\u9645\u5206\u914d\u7684 lenTotal\u3002\u4fee\u590d PR \u89c1 https://gitcode.com/opengauss/openGauss-server/pull/9380 \u3002"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T02:31:01.069Z",
"orgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"shortName": "openGauss"
},
"references": [
{
"url": "https://gitcode.com/opengauss/openGauss-server/pull/9380"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "HLL \u53cd\u5e8f\u5217\u5316 lenTotal/lenUsed \u6821\u9a8c\u7f3a\u5931\u5bfc\u81f4\u5806\u8d8a\u754c\u5199",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"assignerShortName": "openGauss",
"cveId": "CVE-2026-111441",
"datePublished": "2026-10-19T02:31:01.069Z",
"dateReserved": "2026-10-16T03:04:58.958Z",
"dateUpdated": "2026-10-19T17:42:42.026Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14178 (GCVE-0-2026-14178)
Vulnerability from cvelistv5 – Published: 2026-06-30 13:56 – Updated: 2026-06-30 14:40
VLAI
EPSS
VEX
Title
openGauss存在非法内存访问导致DoS漏洞
Summary
openGauss 在处理带 NLS 参数的 to_timestamp 调用时，to_timestamp_with_fmt_nls() 会将 nls_fmt_str 保存到 u_sess->parser_cxt.nls_fmt_str。在 seqscan + sort 执行路径下，该字符串原本被分配在 SeqScan 的表达式上下文中；当 SeqScan 完成后，该内存上下文会被 reset，但后续结果输出阶段 timestamp_out() 仍会通过 CheckNlsFormat() 访问 u_sess->parser_cxt.nls_fmt_str，导致访问已释放内存。攻击者在具备数据库 SQL 执行权限的情况下，可构造特定 to_timestamp(..., ..., nlsparam) 查询触发 heap-use-after-free。在 ASan/Memcheck 环境下表现为数据库服务退出；在实际运行环境中可能造成后端进程异常退出，影响数据库服务可用性，形成拒绝服务风险。该问题在openGauss-server-7.0.0-RC1版本和openGauss-server-7.0.0-RC2版本存在，目前已在openGauss-server-7.0.0-RC3版本修复。由于
openGauss-server-7.0.0-RC1版本和openGauss-server-7.0.0-RC2均为创新版本，不会发布针对性补丁包，涉及版本升级至
openGauss-server-7.0.0-RC3或更新版本即可。
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-30 14:39 UTC
CWE
- CWE-416 - Use after free
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| openGauss-server | openGauss-server-7.0.0-RC2 |
Affected:
openGauss-server-7.0.0-RC2
|
|
| openGauss-server | openGauss-server-7.0.0-RC1 |
Affected:
openGauss-server-7.0.0-RC1
|
|
| openGauss-server | openGauss-server-7.0.0-RC3 |
Unaffected:
openGauss-server-7.0.0-RC3
|
Date Public
2026-06-30 07:53
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-30T14:39:56.155795Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T14:40:10.603Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0-RC2",
"defaultStatus": "affected",
"platforms": [
"openEuler",
"Centos"
],
"product": "openGauss-server-7.0.0-RC2",
"vendor": "openGauss-server",
"versions": [
{
"status": "affected",
"version": "openGauss-server-7.0.0-RC2"
}
]
},
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0-RC1",
"defaultStatus": "affected",
"platforms": [
"openEuler",
"Centos"
],
"product": "openGauss-server-7.0.0-RC1",
"vendor": "openGauss-server",
"versions": [
{
"status": "affected",
"version": "openGauss-server-7.0.0-RC1"
}
]
},
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0-RC3",
"defaultStatus": "unaffected",
"platforms": [
"openEuler Centos"
],
"product": "openGauss-server-7.0.0-RC3",
"vendor": "openGauss-server",
"versions": [
{
"status": "unaffected",
"version": "openGauss-server-7.0.0-RC3"
}
]
}
],
"datePublic": "2026-06-30T07:53:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u0026nbsp;openGauss \u5728\u5904\u7406\u5e26 NLS \u53c2\u6570\u7684 to_timestamp \u8c03\u7528\u65f6\uff0cto_timestamp_with_fmt_nls() \u4f1a\u5c06 nls_fmt_str \u4fdd\u5b58\u5230 u_sess-\u0026gt;parser_cxt.nls_fmt_str\u3002\u5728 seqscan + sort \u6267\u884c\u8def\u5f84\u4e0b\uff0c\u8be5\u5b57\u7b26\u4e32\u539f\u672c\u88ab\u5206\u914d\u5728 SeqScan \u7684\u8868\u8fbe\u5f0f\u4e0a\u4e0b\u6587\u4e2d\uff1b\u5f53 SeqScan \u5b8c\u6210\u540e\uff0c\u8be5\u5185\u5b58\u4e0a\u4e0b\u6587\u4f1a\u88ab reset\uff0c\u4f46\u540e\u7eed\u7ed3\u679c\u8f93\u51fa\u9636\u6bb5 timestamp_out() \u4ecd\u4f1a\u901a\u8fc7 CheckNlsFormat() \u8bbf\u95ee u_sess-\u0026gt;parser_cxt.nls_fmt_str\uff0c\u5bfc\u81f4\u8bbf\u95ee\u5df2\u91ca\u653e\u5185\u5b58\u3002\u653b\u51fb\u8005\u5728\u5177\u5907\u6570\u636e\u5e93 SQL \u6267\u884c\u6743\u9650\u7684\u60c5\u51b5\u4e0b\uff0c\u53ef\u6784\u9020\u7279\u5b9a to_timestamp(..., ..., nlsparam) \u67e5\u8be2\u89e6\u53d1 heap-use-after-free\u3002\u5728 ASan/Memcheck \u73af\u5883\u4e0b\u8868\u73b0\u4e3a\u6570\u636e\u5e93\u670d\u52a1\u9000\u51fa\uff1b\u5728\u5b9e\u9645\u8fd0\u884c\u73af\u5883\u4e2d\u53ef\u80fd\u9020\u6210\u540e\u7aef\u8fdb\u7a0b\u5f02\u5e38\u9000\u51fa\uff0c\u5f71\u54cd\u6570\u636e\u5e93\u670d\u52a1\u53ef\u7528\u6027\uff0c\u5f62\u6210\u62d2\u7edd\u670d\u52a1\u98ce\u9669\u3002\u8be5\u95ee\u9898\u5728openGauss-server-7.0.0-RC1\u7248\u672c\u548copenGauss-server-7.0.0-RC2\u7248\u672c\u5b58\u5728\uff0c\u76ee\u524d\u5df2\u5728openGauss-server-7.0.0-RC3\u7248\u672c\u4fee\u590d\u3002\u7531\u4e8e\nopenGauss-server-7.0.0-RC1\u7248\u672c\u548copenGauss-server-7.0.0-RC2\u5747\u4e3a\u521b\u65b0\u7248\u672c\uff0c\u4e0d\u4f1a\u53d1\u5e03\u9488\u5bf9\u6027\u8865\u4e01\u5305\uff0c\u6d89\u53ca\u7248\u672c\u5347\u7ea7\u81f3\nopenGauss-server-7.0.0-RC3\u6216\u66f4\u65b0\u7248\u672c\u5373\u53ef\u3002"
}
],
"value": "openGauss \u5728\u5904\u7406\u5e26 NLS \u53c2\u6570\u7684 to_timestamp \u8c03\u7528\u65f6\uff0cto_timestamp_with_fmt_nls() \u4f1a\u5c06 nls_fmt_str \u4fdd\u5b58\u5230 u_sess-\u003eparser_cxt.nls_fmt_str\u3002\u5728 seqscan + sort \u6267\u884c\u8def\u5f84\u4e0b\uff0c\u8be5\u5b57\u7b26\u4e32\u539f\u672c\u88ab\u5206\u914d\u5728 SeqScan \u7684\u8868\u8fbe\u5f0f\u4e0a\u4e0b\u6587\u4e2d\uff1b\u5f53 SeqScan \u5b8c\u6210\u540e\uff0c\u8be5\u5185\u5b58\u4e0a\u4e0b\u6587\u4f1a\u88ab reset\uff0c\u4f46\u540e\u7eed\u7ed3\u679c\u8f93\u51fa\u9636\u6bb5 timestamp_out() \u4ecd\u4f1a\u901a\u8fc7 CheckNlsFormat() \u8bbf\u95ee u_sess-\u003eparser_cxt.nls_fmt_str\uff0c\u5bfc\u81f4\u8bbf\u95ee\u5df2\u91ca\u653e\u5185\u5b58\u3002\u653b\u51fb\u8005\u5728\u5177\u5907\u6570\u636e\u5e93 SQL \u6267\u884c\u6743\u9650\u7684\u60c5\u51b5\u4e0b\uff0c\u53ef\u6784\u9020\u7279\u5b9a to_timestamp(..., ..., nlsparam) \u67e5\u8be2\u89e6\u53d1 heap-use-after-free\u3002\u5728 ASan/Memcheck \u73af\u5883\u4e0b\u8868\u73b0\u4e3a\u6570\u636e\u5e93\u670d\u52a1\u9000\u51fa\uff1b\u5728\u5b9e\u9645\u8fd0\u884c\u73af\u5883\u4e2d\u53ef\u80fd\u9020\u6210\u540e\u7aef\u8fdb\u7a0b\u5f02\u5e38\u9000\u51fa\uff0c\u5f71\u54cd\u6570\u636e\u5e93\u670d\u52a1\u53ef\u7528\u6027\uff0c\u5f62\u6210\u62d2\u7edd\u670d\u52a1\u98ce\u9669\u3002\u8be5\u95ee\u9898\u5728openGauss-server-7.0.0-RC1\u7248\u672c\u548copenGauss-server-7.0.0-RC2\u7248\u672c\u5b58\u5728\uff0c\u76ee\u524d\u5df2\u5728openGauss-server-7.0.0-RC3\u7248\u672c\u4fee\u590d\u3002\u7531\u4e8e\nopenGauss-server-7.0.0-RC1\u7248\u672c\u548copenGauss-server-7.0.0-RC2\u5747\u4e3a\u521b\u65b0\u7248\u672c\uff0c\u4e0d\u4f1a\u53d1\u5e03\u9488\u5bf9\u6027\u8865\u4e01\u5305\uff0c\u6d89\u53ca\u7248\u672c\u5347\u7ea7\u81f3\nopenGauss-server-7.0.0-RC3\u6216\u66f4\u65b0\u7248\u672c\u5373\u53ef\u3002"
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use after free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T13:56:16.846Z",
"orgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"shortName": "openGauss"
},
"references": [
{
"url": "https://gitcode.com/opengauss/openGauss-server/pull/8877"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "openGauss\u5b58\u5728\u975e\u6cd5\u5185\u5b58\u8bbf\u95ee\u5bfc\u81f4DoS\u6f0f\u6d1e",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"assignerShortName": "openGauss",
"cveId": "CVE-2026-14178",
"datePublished": "2026-06-30T13:56:16.846Z",
"dateReserved": "2026-06-30T07:37:54.949Z",
"dateUpdated": "2026-06-30T14:40:10.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}