CVE-2026-14178

Name of the Vulnerable Software and Affected Versions openGauss-server versions 7.0.0-RC1 through 7.0.0-RC2

Description A heap-use-after-free occurs when processing to timestamp calls with NLS parameters. The function to timestamp with fmt nls() saves nls fmt str to u sess->parser cxt.nls fmt str. In a seqscan and sort execution path, this string is allocated in the SeqScan expression context. Once the SeqScan completes, the memory context is reset, but the timestamp out() function subsequently attempts to access u sess->parser cxt.nls fmt str via CheckNlsFormat(), leading to the access of freed memory. An attacker with SQL execution permissions can construct a specific to timestamp(..., ..., nlsparam) query to trigger this issue, which may cause backend processes to crash and result in a denial of service.

Recommendations Upgrade openGauss-server versions 7.0.0-RC1 through 7.0.0-RC2 to version 7.0.0-RC3 or later.