Read the docs
TI-2026-76236 Aliases CVE-2026-111440GHSA-4fmq-r5rm-vvmw

Unsafe reflection in openGauss JDBC LogFactory enables class loading

Priority LOW 32CWE-470Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

openGauss-connector-jdbc versions 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.1.0, 3.0.0-3.0.5, 3.1.0-3.1.1, 5.0.0-5.0.3, 5.1.0, 5.0.0-RC1, 6.0.0-RC1, 6.0.0-6.0.6, 7.0.0-RC1, 7.0.0-RC2 and 7.0.0-RC3 are affected. LogFactory instantiates a class named by the logger setting before checking that it implements Log, which is unsafe reflection (CWE-470). An attacker who controls the logger class name in the JDBC URL or connection properties can trigger unintended class loading and construction on the client.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。 此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed openGauss-connector-jdbc (openGauss-server): 7.0.0-LTS

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openGauss-serveropenGauss-connector-jdbc1.0.0, 1.0.1, 1.1.0; 2.0.0, 2.1.0; 3.0.0-3.0.5; 3.1.0-3.1.1; 5.0.0-5.0.3; 5.1.0; 5.0.0-RC1; 6.0.0-RC1; 6.0.0-6.0.6; 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC37.0.0-LTSPatch availableCNA
  • openGauss-connector-jdbc VendoropenGauss-server Affected 1.0.0, 1.0.1, 1.1.0; 2.0.0, 2.1.0; 3.0.0-3.0.5; 3.1.0-3.1.1; 5.0.0-5.0.3; 5.1.0; 5.0.0-RC1; 6.0.0-RC1; 6.0.0-6.0.6; 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3 Fixed in 7.0.0-LTS Patch available CNA

Remediation

Upgrade openGauss-connector-jdbc to 7.0.0-LTS, which fixes the flaw by checking for Log subclasses before construction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA openGauss-connector-jdbc (openGauss-server) Fixed in 7.0.0-LTS

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-111440
  2. 2026-10-19 Alias added: GHSA-4fmq-r5rm-vvmw
  3. 2026-10-19 Affected versions changed · CNA
  4. 2026-10-19 CISA SSVC decision points changed
  5. 2026-10-19 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-76229 Heap overflow in openGauss HLL unpacking from missing length check CVSS 3.1HIGH 8.1
  • TI-2026-76280 Authentication bypass in openGauss-server replication connections CVSS 3.1MEDIUM 6.5
  • TI-2026-12011 openGauss存在非法内存访问导致DoS漏洞 CVSS 3.1MEDIUM 5.9
  • TI-2026-76281 Missing permission check in openGauss lets users read table file blocks CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences