JDBC Logger Class Reflection Vulnerability in openGauss Connector by openGauss

CVE-2026-111440

What is CVE-2026-111440?

The vulnerability within the openGauss Connector JDBC arises from the LogFactory class's handling of logger class names specified in JDBC connection parameters. It uses Class.forName to load these classes without confirming if they are indeed subclasses of Log, making it possible for an attacker to introduce unexpected classes through a manipulated JDBC URL or connection attributes. This could lead to uncontrolled class loading and initialization effects on the client side. A fix has been implemented to ensure that only Log subclasses can be instantiated by performing asSubclass(Log.class) checks after the class loading action.

References