Executive brief
openGauss is an open-source relational database management system. A vulnerability in how the database handles specific time-conversion functions could allow an attacker to crash the database service. This results in a denial-of-service, potentially disrupting business operations and data availability.
Technical details
A heap use-after-free vulnerability exists in openGauss-server's to_timestamp_with_fmt_nls() function. When processing a to_timestamp call with NLS parameters during a seqscan + sort execution path, the nls_fmt_str is stored in a memory context that is reset after the scan completes. Subsequent calls to timestamp_out() via CheckNlsFormat() attempt to access this freed memory. An attacker with SQL execution privileges can trigger this by constructing a specific query, resulting in a backend process crash or a full service exit in environments with memory sanitizers. The issue is fixed in version 7.0.0-RC3.
Affected products
- openGauss openGauss-server 7.0.0-RC1, 7.0.0-RC2
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory
- 2026-06-30: patched: Fixed in 7.0.0-RC3