Read the docs
TI-2026-44505 Aliases CVE-2026-62351

TDengine: Unauthenticated Remote Denial of Service via Out-of-Bounds Read in transDecompressMsg

Priority HIGH 72CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg() read STransCompMsg.contLen when pHead->comp == 1 without first validating that the RPC packet contained the 8-byte STransCompMsg structure, causing an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server crash. This issue is fixed in version 3.4.1.15.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Fixed TDengine (taosdata): 3.4.1.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
taosdataTDenginebefore 3.4.1.153.4.1.15Patch availableCNA
  • TDengine Vendortaosdata Affected before 3.4.1.15 Fixed in 3.4.1.15 Patch available CNA

Remediation

  • Fix · CNA TDengine (taosdata) Fixed in 3.4.1.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62351

References

Other 1

  • TI-2023-16957 Command Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanaplugin CVSS 3.1CRITICAL 9.8
  • TI-2026-44503 TDengine: Off-by-One Buffer Overflow CVSS 3.1HIGH 8.3
  • TI-2026-44504 TDengine: UDF lead to RCE CVSS 3.1HIGH 7.2
  • TI-2023-19882 TDengine Database Denial-of-Service CVSS 3.1MEDIUM 6.5
  • TI-2026-44506 TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken CVSS 3.1MEDIUM 5.4
  • TI-2026-44502 TDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations CVSS 3.1MEDIUM 5.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences