# CVE-2026-14178: openGauss use-after-free in to_timestamp with NLS parameters

Source: https://junglewise.ai/threats/cve-2026-14178-opengauss-use-after-free-in-to-timestamp-with-nls-parameters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-14178 · Severity: medium · CVSS 5.9 · Published 2026-06-30

openGauss is an open-source relational database management system. A vulnerability in how the database handles specific time-conversion functions could allow an attacker to crash the database service. This results in a denial-of-service, potentially disrupting business operations and data availability.

Vendors: [openGauss](https://junglewise.ai/threats/vendors/opengauss).

## Quick answers

**Is CVE-2026-14178 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14178 being exploited in the wild.

**How severe is CVE-2026-14178?** Medium severity, with a CVSS score of 5.9, published 30 June 2026.

**Which products and versions are affected?** openGauss-server 7.0.0-RC1, 7.0.0-RC2.

**Is there a fix for CVE-2026-14178?** A patch was published on 2026-06-30: Fixed in 7.0.0-RC3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14178 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-14178?** Check whether you run openGauss-server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap use-after-free vulnerability exists in openGauss-server's to_timestamp_with_fmt_nls() function. When processing a to_timestamp call with NLS parameters during a seqscan + sort execution path, the nls_fmt_str is stored in a memory context that is reset after the scan completes. Subsequent calls to timestamp_out() via CheckNlsFormat() attempt to access this freed memory. An attacker with SQL execution privileges can trigger this by constructing a specific query, resulting in a backend process crash or a full service exit in environments with memory sanitizers. The issue is fixed in version 7.0.0-RC3.

## Affected products

- openGauss openGauss-server 7.0.0-RC1, 7.0.0-RC2

## Timeline

- 2026-06-30: disclosed
- 2026-06-30: advisory
- 2026-06-30: patched: Fixed in 7.0.0-RC3

## References

- [https://opengauss.org/zh/download/archive/?version=7.0.0-RC2](https://opengauss.org/zh/download/archive/?version=7.0.0-RC2)
- [https://opengauss.org/zh/download/archive/?version=7.0.0-RC1](https://opengauss.org/zh/download/archive/?version=7.0.0-RC1)
- [https://opengauss.org/zh/download/archive/?version=7.0.0-RC3](https://opengauss.org/zh/download/archive/?version=7.0.0-RC3)
- [https://gitcode.com/opengauss/openGauss-server/pull/8877](https://gitcode.com/opengauss/openGauss-server/pull/8877)

## Related threats

- [openGauss-server replication authentication bypass in hba.cpp](https://junglewise.ai/threats/cve-2026-111438-opengauss-server-src-common-backend-libpq-hba-cpp-hba)