What is CVE-2026-14178?

CVE-2026-14178 is a medium-severity vulnerability in Opengauss-server Opengauss-server-7.0.0-rc1, classified under Use After Free. CVSS score: 5.9/10. Published 2026-06-30.

How severe is CVE-2026-14178?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Use After Free in Opengauss-server Opengauss-server-7.0.0-rc1

CVE-2026-14178

openGauss 在处理带 NLS 参数的 to_timestamp 调用时，to_timestamp_with_fmt_nls() 会将 nls_fmt_str 保存到 u_sess->parser_cxt.nls_fmt_str。在 seqscan + sort 执行路径下，该字符串原本被分配在 SeqScan 的表达式上下文中；当 SeqScan 完成后，该内存上下文会被 reset，但后续结果输出阶段 timestamp_out() 仍会通过 CheckNlsFo…

Vulnerability class: Use-After-Free

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Opengauss-server Opengauss-server-7.0.0-rc1 — versions openGauss-server-7.0.0-RC1
Opengauss-server Opengauss-server-7.0.0-rc2 — versions openGauss-server-7.0.0-RC2
Opengauss-server Opengauss-server-7.0.0-rc3 — versions openGauss-server-7.0.0-RC3

Weakness classification (CWE)

CWE-416 — Use After Free

References

a1a479f7-907b-4ae8-a999-9148cadc9224

Frequently asked questions

What is CVE-2026-14178?: CVE-2026-14178 is a medium-severity vulnerability in Opengauss-server Opengauss-server-7.0.0-rc1, classified under Use After Free. CVSS score: 5.9/10. Published 2026-06-30.
How severe is CVE-2026-14178?: Medium severity. CVSS v3 base score is 5.9 out of 10.