Executive brief
TDengine is an open-source database designed to handle large amounts of data from Internet of Things (IoT) devices. A security flaw allows an unauthenticated attacker to crash the database server by sending a single specially crafted network packet. This results in a total service outage, preventing the system from recording or querying data until it is manually restarted.
Technical details
An integer underflow vulnerability exists in the `uvConnMayGetUserInfo()` function within `source/libs/transport/src/transSvr.c`. The root cause is a mixed-type subtraction involving the client-supplied `len` field and internal offsets without proper bounds checking. When an attacker sends a crafted RPC packet where `len` is smaller than the expected overhead, the subtraction results in a massive value (integer wrap-around), causing `memcpy` to trigger a segmentation fault. This can be exploited remotely without authentication or prior session state. The issue is resolved in version 3.4.1.6 by adding explicit length validation.
Affected products
- taosdata TDengine 3.4.0.0 - 3.4.1.5
Timeline
- 2026-04-30: patched: Version 3.4.1.6 released
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD