CVE-2026-14178 Overview
CVE-2026-14178 is a heap use-after-free vulnerability [CWE-416] in the openGauss database server. The flaw resides in to_timestamp_with_fmt_nls(), which stores an nls_fmt_str pointer into u_sess->parser_cxt.nls_fmt_str. Under a seqscan + sort execution path, the string is allocated in the SeqScan expression context. When the SeqScan finishes, the memory context is reset, but timestamp_out() still dereferences the freed pointer through CheckNlsFormat() during result output. An authenticated attacker with SQL execution privileges can trigger the condition with a crafted to_timestamp(..., ..., nlsparam) query, causing backend process termination and denial of service.
Critical Impact
Authenticated attackers can crash openGauss backend processes and disrupt database service availability through a single crafted SQL query.
Affected Products
- openGauss-server 7.0.0-RC1
- openGauss-server 7.0.0-RC2
- Fixed in openGauss-server 7.0.0-RC3
Discovery Timeline
- 2026-06-30 - CVE-2026-14178 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-14178
Vulnerability Analysis
The vulnerability affects openGauss processing of to_timestamp calls that include NLS (National Language Support) parameters. The function to_timestamp_with_fmt_nls() copies the NLS format string into the session-level parser context field u_sess->parser_cxt.nls_fmt_str. This field acts as a cross-node reference used later during result serialization.
During query execution with a seqscan + sort plan, the NLS format string is allocated within the SeqScan node's expression context. Once the SeqScan node completes, its memory context is reset and the allocation is freed. However, u_sess->parser_cxt.nls_fmt_str retains the dangling pointer. When the sort output stage invokes timestamp_out(), the call chain reaches CheckNlsFormat(), which dereferences the freed memory region.
Under AddressSanitizer or Valgrind Memcheck instrumentation, the access is reported as a heap-use-after-free and the database service exits. In production builds, the same condition can corrupt state or terminate the backend process, resulting in loss of database availability.
Root Cause
The root cause is a lifetime mismatch between the memory context that owns the NLS format string and the session-level pointer that references it. Storing a pointer that outlives its allocating context in u_sess->parser_cxt.nls_fmt_str violates memory context ownership rules used throughout the PostgreSQL-derived codebase.
Attack Vector
Exploitation requires a valid database session with SQL execution privileges. The attacker submits a query that invokes to_timestamp with an NLS parameter and produces a plan that includes both a sequential scan and a sort operation. Execution of the query triggers the free-then-use sequence during result output. The vulnerability is network-reachable through standard database client protocols but has high attack complexity due to the specific plan shape required.
No verified public proof-of-concept code is available. Refer to the GitCode Pull Request for the upstream fix and technical context.
Detection Methods for CVE-2026-14178
Indicators of Compromise
- Unexpected termination of openGauss backend processes with SIGSEGV or SIGABRT signals in the postmaster log.
- Database server crashes correlated with client sessions executing to_timestamp(..., ..., nlsparam) queries.
- Repeated backend restart events without corresponding configuration or workload changes.
Detection Strategies
- Enable AddressSanitizer or Valgrind Memcheck in non-production environments to surface heap-use-after-free reports on nls_fmt_str.
- Audit query logs for occurrences of to_timestamp calls with three arguments that include an NLS format parameter.
- Correlate database process exit events with active user sessions to identify potential attempts to exploit the condition.
Monitoring Recommendations
- Ship openGauss server logs and OS-level crash dumps to a centralized analytics platform for time-series analysis.
- Alert on backend termination rates exceeding a baseline threshold within short intervals.
- Track SQL execution privileges granted to non-administrative roles and review access to functions accepting NLS parameters.
How to Mitigate CVE-2026-14178
Immediate Actions Required
- Upgrade openGauss-server to version 7.0.0-RC3 or later, which contains the upstream fix.
- Restrict SQL execution privileges to trusted roles until the upgrade is complete.
- Review application code paths that construct to_timestamp calls with NLS parameters and validate necessity.
Patch Information
The vendor has fixed the issue in openGauss-server 7.0.0-RC3. Because 7.0.0-RC1 and 7.0.0-RC2 are innovation releases, no back-ported patch packages will be issued. Affected deployments must upgrade to 7.0.0-RC3 or a newer release. The fix is available in the GitCode Pull Request.
Workarounds
- Revoke direct SQL execution rights from untrusted database users until the server is upgraded.
- Block or rewrite application queries that call to_timestamp with an NLS format parameter.
- Deploy database activity monitoring rules that reject queries matching the vulnerable call pattern at the proxy layer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
