Executive brief
TDengine is a high-performance database designed for Internet of Things (IoT) data. A vulnerability in its communication layer allows an unauthenticated attacker to crash the database server by sending a specially crafted network packet. This results in a denial-of-service (DoS) condition, disrupting data collection and operations for connected IoT devices.
Technical details
An out-of-bounds read vulnerability exists in the transDecompressMsg() function within source/libs/transport/src/transComm.c. When the RPC layer receives a packet with the compression flag set (comp=1), it fails to verify that the packet is large enough to contain the 8-byte STransCompMsg structure before reading the contLen field. This leads to an out-of-bounds read, followed by an uncontrolled memory allocation and an integer underflow when calculating decompression lengths for LZ4. An unauthenticated attacker can trigger this remotely to cause an immediate server crash. The issue is fixed in version 3.4.1.15.
Affected products
- taosdata TDengine < 3.4.1.15
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date