CVE-2026-111441— HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写
Quick assessment
Affected
openGauss-server openGauss-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
In the file of openGauss-server, the built-in function contains a length validation flaw. After parsing and from a user-supplied packed HLL, the function only verifies that the input length is sufficient to cover . It then allocates a buffer based on and invok
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111441
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写
Source: CVE Program / CVE List V5
Vulnerability Description
在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的 lenTotal，导致安全拷贝无法拦截越界写。hll_in()、hll_print()、hll_cardinality() 等 SQL 入口会走同一解包路径。因此，普通数据库连接用户只需构造 lenTotal 小于 lenUsed 的畸形 packed HLL（例如经 ::hll 进入 hll_in()），即可触发服务端堆越界写，存在内存破坏风险。此问题随 packed HLL 解包函数 HllObjectUnpack() 进入代码，v2.1.0 起即存在。受影响版本包括 2.1.0、3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS 版本修复，通过在 HllObjectUnpack() 中补齐 lenUsed <= lenTotal 校验，并将 memcpy_s() 的目标大小改为实际分配的 lenTotal。修复 PR 见 https://gitcode.com/opengauss/openGauss-server/pull/9380 。
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| openGauss-server | openGauss-server | - | - |
|
| openGauss-server | openGauss-server | 7.0.0-RC1, 7.0.0-RC2 7.0.0-RC3 | - |
|
II. Public POCs for CVE-2026-111441
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111441
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-111441 (1)
Same Patch Batch · openGauss-server · 2026-10-19 · 4 CVEs total
| CVE-2026-111440 | 7.0 HIGH | JDBC LogFactory 任意类加载/构造导致潜在 RCE |
| CVE-2026-111438 | 6.5 MEDIUM | check_hba_replication 认证与访问控制绕过 |
| CVE-2026-111439 | 4.3 MEDIUM | pg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块 |
IV. Related Vulnerabilities
Same weakness: CWE-122
-
CVE-2026-112021
snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser -
CVE-2026-111458
ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Form -
CVE-2026-111381
FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Ca -
CVE-2026-111379
FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_ca -
CVE-2026-108450
Microsoft Office Word Remote Code Execution Vulnerability
V. Comments for CVE-2026-111441
No comments yet