CVE-2026-111440
Received Received - Intake

Class Loading Vulnerability in openGauss JDBC Connector

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: openGauss Community

Description
在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。 此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111440
EUVD
EUVD-2026-104058

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
openGauss-server openGauss-connector-jdbc 1.0.0, 1.0.1, 1.1.0
openGauss-server openGauss-connector-jdbc 2.0.0, 2.1.0
openGauss-server openGauss-connector-jdbc 3.0.0-3.0.5
openGauss-server openGauss-connector-jdbc 3.10-3.1.1
openGauss-server openGauss-connector-jdbc 5.0.0-5.0.3
openGauss-server openGauss-connector-jdbc 5.1.0
openGauss-server openGauss-connector-jdbc 5.0.0-RC1
openGauss-server openGauss-connector-jdbc 6.0.0-RC1
openGauss-server openGauss-connector-jdbc 6.0.0-6.0.6
openGauss-server openGauss-connector-jdbc 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in openGauss-connector-jdbc's LogFactory class. It loads a logger class specified in JDBC connection parameters using reflection without proper type validation. An attacker could exploit this by controlling the logger class name in the JDBC URL or connection properties, potentially triggering unintended class loading and side effects if malicious classes exist in the classpath.

Detection Guidance

This vulnerability involves unsafe class loading via JDBC connection parameters. To detect it, inspect applications using openGauss-connector-jdbc versions 1.1.0 to 7.0.0-RC3 for suspicious logger class names in JDBC URLs or connection properties. Check classpath for untrusted classes that could be loaded via the logger parameter.

Impact Analysis

An attacker could execute arbitrary code on the client side by exploiting this vulnerability. This could lead to data breaches, unauthorized access, or system compromise if the malicious class performs harmful operations during instantiation.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected versions may face compliance violations and regulatory penalties.

Mitigation Strategies

Upgrade to openGauss-connector-jdbc 7.0.0-LTS or later. If upgrading is not immediately possible, restrict JDBC connection parameters to prevent attacker-controlled logger class names. Review classpath for untrusted classes that could be exploited via this vector.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111440. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart