CVE-2026-111441

Name of the Vulnerable Software and Affected Versions openGauss-server versions 2.1.0 through 7.0.0-RC3

Description An issue exists in the HllObjectUnpack() function within the src/gausskernel/cbb/utils/hll/hll.cpp file. The function fails to properly validate the length of packed HyperLogLog (HLL) data. Specifically, it does not verify if lenTotal is greater than or equal to lenUsed and incorrectly uses lenUsed as the destination size in the memcpy s() function instead of the allocated lenTotal. This allows a user with a standard database connection to trigger a heap-based out-of-bounds write by providing a malformed packed HLL where lenTotal is smaller than lenUsed. This can be achieved through SQL entry points such as hll in(), hll print(), and hll cardinality(), leading to potential memory corruption.

Recommendations Update openGauss-server to version 7.0.0-LTS.