{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-111440",
        "assignerOrgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
        "state": "PUBLISHED",
        "assignerShortName": "openGauss",
        "dateReserved": "2026-10-16T03:04:57.224Z",
        "datePublished": "2026-10-19T03:55:19.107Z",
        "dateUpdated": "2026-10-19T17:39:59.272Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
                "shortName": "openGauss",
                "dateUpdated": "2026-10-19T08:12:17.254Z"
            },
            "title": "JDBC LogFactory 任意类加载/构造导致潜在 RCE",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-470",
                            "description": "CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection')",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-138",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-138 Reflection Injection"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "openGauss-server",
                    "product": "openGauss-connector-jdbc",
                    "platforms": [
                        "openEuler",
                        "Centos"
                    ],
                    "collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0-RC3",
                    "versions": [
                        {
                            "status": "unaffected",
                            "version": "7.0.0-LTS"
                        },
                        {
                            "status": "affected",
                            "version": "1.0.0, 1.0.1, 1.1.0"
                        },
                        {
                            "status": "affected",
                            "version": "2.0.0, 2.1.0"
                        },
                        {
                            "status": "affected",
                            "version": "3.0.0-3.0.5"
                        },
                        {
                            "status": "affected",
                            "version": "3.1.0-3.1.1"
                        },
                        {
                            "status": "affected",
                            "version": "5.0.0-5.0.3"
                        },
                        {
                            "status": "affected",
                            "version": "5.1.0"
                        },
                        {
                            "status": "affected",
                            "version": "5.0.0-RC1"
                        },
                        {
                            "status": "affected",
                            "version": "6.0.0-RC1"
                        },
                        {
                            "status": "affected",
                            "version": "6.0.0-6.0.6"
                        },
                        {
                            "status": "affected",
                            "version": "7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。\n\n此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。<br><br>此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423"
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV3_1": {
                        "version": "3.1",
                        "attackVector": "LOCAL",
                        "attackComplexity": "HIGH",
                        "privilegesRequired": "LOW",
                        "userInteraction": "NONE",
                        "scope": "UNCHANGED",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "HIGH",
                        "availabilityImpact": "HIGH",
                        "baseSeverity": "HIGH",
                        "baseScore": 7,
                        "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
                    }
                }
            ],
            "source": {
                "discovery": "EXTERNAL"
            },
            "x_generator": {
                "engine": "Vulnogram 1.0.5"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-10-19T17:39:30.858779Z",
                                "id": "CVE-2026-111440",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-10-19T17:39:59.272Z"
                }
            }
        ]
    }
}