Length Validation Flaw in openGauss-server Affects Memory Management

CVE-2026-111441

What is CVE-2026-111441?

The openGauss-server has a flaw in the HllObjectUnpack() function, which improperly checks the length of user-provided packed HLL data. While it verifies that the length is adequate to cover a header size plus a used length, it fails to ensure that the total length is not less than the used length. As a result, when handling SQL entries such as hll_in(), users can exploit this flaw by providing crafted packets, leading to potential heap overflows and memory corruption. Affected versions include 2.1.0 through 6.0.x and specific release candidates of 7.0. The issue has been addressed in the 7.0.0-LTS version by implementing additional checks in the unpacking logic to ensure safe memory operations.

References