{"id":"CVE-2026-111440","revision":"13ca9d87d0b644969a58888c20851d1a","records":[{"revision":"13ca9d87d0b644969a58888c20851d1a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-111440","aliases":[],"title":"JDBC LogFactory 任意类加载/构造导致潜在 RCE","description":"在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。\n\n此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。","state":0,"publishedAt":"2026-10-19T03:55:19.107+00:00","modifiedAt":"2026-10-19T17:39:59.272+00:00","affected":[{"ecosystem":"https://opengauss.org/zh/download/archive/?version=7.0.0-RC3","name":"openGauss-connector-jdbc","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"openGauss-server\",\n                    \"product\": \"openGauss-connector-jdbc\",\n                    \"platforms\": [\n                        \"openEuler\",\n                        \"Centos\"\n                    ],\n                    \"collectionURL\": \"https://opengauss.org/zh/download/archive/?version=7.0.0-RC3\",\n                    \"versions\": [\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"7.0.0-LTS\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.0.0, 1.0.1, 1.1.0\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.0.0, 2.1.0\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"3.0.0-3.0.5\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"3.1.0-3.1.1\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.0.0-5.0.3\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.1.0\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.0.0-RC1\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"6.0.0-RC1\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"6.0.0-6.0.6\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7,"severity":"HIGH"}],"references":["https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111440","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111440","identifiers":["CVE-2026-111440"]},"retained":false,"historicalAffected":[]}],"coverage":[]}