CVE-2026-111441
HighCVSS 8.1Summary
In openGauss-server's hll.cpp, the HllObjectUnpack() function has a length validation flaw. After parsing lenUsed and lenTotal from user-supplied packed HLL, it only checks that input length covers HLL_HEAD_SIZE + lenUsed, then allocates a buffer by lenTotal and copies via memcpy_s() by lenUsed, without validating lenTotal >= lenUsed and passing lenUsed instead of lenTotal as destination size. A regular database user can craft a malformed packed HLL (e.g., via ::hll into hll_in()) to trigger a server-side heap overflow.
Risk Assessment
A regular database user can cause memory corruption on the database server, potentially leading to crashes or code execution.
Recommendation
Upgrade openGauss-server to version 7.0.0-LTS or later, which adds lenUsed <= lenTotal validation and fixes the memcpy_s() destination size.
Other vulnerabilities in openGauss-server
See all- CVE-2026-111438Medium
In openGauss-server, src/common/backend/libpq/hba.cpp contains an access control bypass in replication connection authentication. hba_getauthmethod() for HADR/SW replication senders does not require is_node_internal_connection() and calls check_hba_replication(), which only performs weak matching on the replication flag, skipping full pg_hba checks (including the remote trust prohibition). This allows external replication connections to bypass internal connection restrictions and full pg_hba policy, enabling reading of backup and log data via the replication protocol.
- CVE-2026-111439Medium
In openGauss-server, the built-in function pg_read_binary_file_blocks() in src/common/backend/utils/adt/genfile.cpp has a permission check flaw. The function only validates the range of startBlockNum and blockCount, then calls ReadBinaryFileBlocksFirstCall(), which does not verify the caller's SELECT privileges. Any user with ordinary database connection access can read binary blocks of table data without SELECT permission if they know the relation file path.
Original NVD description (English source)
在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的 lenTotal，导致安全拷贝无法拦截越界写。hll_in()、hll_print()、hll_cardinality() 等 SQL 入口会走同一解包路径。因此，普通数据库连接用户只需构造 lenTotal 小于 lenUsed 的畸形 packed HLL（例如经 ::hll 进入 hll_in()），即可触发服务端堆越界写，存在内存破坏风险。此问题随 packed HLL 解包函数 HllObjectUnpack() 进入代码，v2.1.0 起即存在。受影响版本包括 2.1.0、3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS 版本修复，通过在 HllObjectUnpack() 中补齐 lenUsed <= lenTotal 校验，并将 memcpy_s() 的目标大小改为实际分配的 lenTotal。修复 PR 见 https://gitcode.com/opengauss/openGauss-server/pull/9380 。
Vulnerability data from NVD (NIST) · CISA KEV · EPSS