EUVD-2026-40326
GHSA-v555-5g3c-vq2x
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Description requires SQL execution privileges (PR:L not PR:N); AC:H retained because the specific seqscan+sort optimizer path must be triggered; no confidentiality or integrity impact.
Primary rating from Vendor (openGauss).
CVSS VectorVendor: openGauss
Lifecycle Timeline
1DescriptionCVE.org
openGauss 在处理带 NLS 参数的 to_timestamp 调用时，to_timestamp_with_fmt_nls() 会将 nls_fmt_str 保存到 u_sess->parser_cxt.nls_fmt_str。在 seqscan + sort 执行路径下，该字符串原本被分配在 SeqScan 的表达式上下文中；当 SeqScan 完成后，该内存上下文会被 reset，但后续结果输出阶段 timestamp_out() 仍会通过 CheckNlsFormat() 访问 u_sess->parser_cxt.nls_fmt_str，导致访问已释放内存。攻击者在具备数据库 SQL 执行权限的情况下，可构造特定 to_timestamp(..., ..., nlsparam) 查询触发 heap-use-after-free。在 ASan/Memcheck 环境下表现为数据库服务退出；在实际运行环境中可能造成后端进程异常退出，影响数据库服务可用性，形成拒绝服务风险。该问题在openGauss-server-7.0.0-RC1版本和openGauss-server-7.0.0-RC2版本存在，目前已在openGauss-server-7.0.0-RC3版本修复。由于 openGauss-server-7.0.0-RC1版本和openGauss-server-7.0.0-RC2均为创新版本，不会发布针对性补丁包，涉及版本升级至 openGauss-server-7.0.0-RC3或更新版本即可。
AnalysisAI
Heap-use-after-free in openGauss 7.0.0-RC1 and RC2 allows a database user with SQL execution privileges to crash the backend process by crafting a to_timestamp() call with NLS parameters that triggers the seqscan+sort execution path. The nls_fmt_str pointer is stored in session context but allocated within SeqScan's expression memory context, which is freed upon scan completion; subsequent access by timestamp_out() via CheckNlsFormat() dereferences the dangling pointer. The practical impact is denial of service through backend process termination. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
openGauss is a relational database management system derived from PostgreSQL, primarily developed and deployed by Huawei. The vulnerability resides in the NLS (National Language Support) extension of the to_timestamp() function, specifically to_timestamp_with_fmt_nls(). This function saves a pointer to nls_fmt_str into a session-level structure (u_sess->parser_cxt.nls_fmt_str) without copying it out of the ephemeral memory context owned by the SeqScan executor node. PostgreSQL-derived databases use per-node expression contexts (ExprContexts) that are reset or freed when the node finishes processing; in the seqscan+sort execution path, this reset occurs before the result output phase completes. CWE-416 (Use After Free) applies directly: the dangling session pointer is then dereferenced inside CheckNlsFormat() called from timestamp_out(), producing a heap-use-after-free. Under AddressSanitizer or Valgrind Memcheck the process exits immediately; in production builds the behaviour is undefined and manifests as backend crash or data corruption. Affected CPEs are cpe:2.3:a:opengauss-server:opengauss-server-7.0.0-rc1 and cpe:2.3:a:opengauss-server:opengauss-server-7.0.0-rc2.
RemediationAI
Vendor-released patch: openGauss-server 7.0.0-RC3. Because RC1 and RC2 are innovation releases, no backport patches will be issued - upgrade to RC3 or a later version is the only supported remediation path per the vendor advisory. The upstream fix is documented in gitcode.com/opengauss/openGauss-server/pull/8877. As a compensating control where immediate upgrade is not feasible, restrict SQL execution privileges to trusted users only and audit role grants to remove unnecessary execute permissions; this limits the attacker surface since exploitation requires an authenticated session. Additionally, consider placing the database behind a connection proxy or PgBouncer-style pool that enforces session limits, which can bound the impact of repeated crash attempts. Note that these controls reduce exposure but do not eliminate the vulnerability.
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today