Read the docs
TI-2026-76229 Aliases CVE-2026-111441GHSA-8rj5-vp35-h5mx

Heap overflow in openGauss HLL unpacking from missing length check

Priority LOW 35CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

openGauss-server versions 2.1.0, 3.0.x, 3.1.x, 5.0.x, 5.1.0, 6.0.x, 7.0.0-RC1, 7.0.0-RC2 and 7.0.0-RC3 are affected. In HllObjectUnpack(), the length check on packed HLL input does not require lenTotal to be at least lenUsed, and memcpy_s() uses lenUsed as the destination size instead of the allocated lenTotal, which causes a heap-based buffer overflow (CWE-122). A low-privileged database user with network access can trigger the out-of-bounds heap write through SQL input functions, which can corrupt server memory. No exploitation is reported.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的 lenTotal，导致安全拷贝无法拦截越界写。hll_in()、hll_print()、hll_cardinality() 等 SQL 入口会走同一解包路径。因此，普通数据库连接用户只需构造 lenTotal 小于 lenUsed 的畸形 packed HLL（例如经 ::hll 进入 hll_in()），即可触发服务端堆越界写，存在内存破坏风险。此问题随 packed HLL 解包函数 HllObjectUnpack() 进入代码，v2.1.0 起即存在。受影响版本包括 2.1.0、3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS 版本修复，通过在 HllObjectUnpack() 中补齐 lenUsed <= lenTotal 校验，并将 memcpy_s() 的目标大小改为实际分配的 lenTotal。修复 PR 见 https://gitcode.com/opengauss/openGauss-server/pull/9380 。

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00404 34th percentileScored 2026-11-07
Fix Fixed openGauss-server (openGauss-server): 7.0.0-LTS

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openGauss-serveropenGauss-server—7.0.0-LTSPatch availableCNA
openGauss-serveropenGauss-server7.0.0-RC1, 7.0.0-RC2 7.0.0-RC3; 2.1.0; 3.0.0-3.0.6; 3.1.0; 5.0.0-5.0.5; 6.0.0-6.0.6—No fix listedCNA
  • openGauss-server VendoropenGauss-server Affected — Fixed in 7.0.0-LTS Patch available CNA
  • openGauss-server VendoropenGauss-server Affected 7.0.0-RC1, 7.0.0-RC2 7.0.0-RC3; 2.1.0; 3.0.0-3.0.6; 3.1.0; 5.0.0-5.0.5; 6.0.0-6.0.6 Fixed in — No fix listed CNA

Remediation

Upgrade openGauss-server to 7.0.0-LTS, which adds the lenUsed <= lenTotal check and sizes the memcpy_s() destination to lenTotal. The sources list no fixed version for openGauss-server.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA openGauss-server (openGauss-server) Fixed in 7.0.0-LTS

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-111441
  2. 2026-10-19 Alias added: GHSA-8rj5-vp35-h5mx
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-76236 Unsafe reflection in openGauss JDBC LogFactory enables class loading CVSS 3.1HIGH 7.0
  • TI-2026-76280 Authentication bypass in openGauss-server replication connections CVSS 3.1MEDIUM 6.5
  • TI-2026-12011 openGauss存在非法内存访问导致DoS漏洞 CVSS 3.1MEDIUM 5.9
  • TI-2026-76281 Missing permission check in openGauss lets users read table file blocks CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences