Executive brief
TDengine is a high-performance database designed for Internet of Things (IoT) data. A security flaw in how the database processes SQL commands allows an authenticated user to crash the server or potentially view small amounts of sensitive memory by sending a specially crafted query. This could lead to service outages and minor data exposure in environments where users have query access.
Technical details
An out-of-bounds read vulnerability exists in the SQL lexer of TDengine within the `tGetToken()` function in `parTokenizer.c`. The root cause is improper handling of escape characters; when a SQL string literal ends with a trailing backslash immediately before the null terminator (e.g., `'abc\`), the parser unconditionally increments the buffer index, causing it to read one byte beyond the allocated memory. An authenticated attacker with permissions to execute SQL queries can exploit this via the network to trigger a SIGSEGV crash or potentially leak adjacent memory. The vulnerability affects multiple entry points including the CLI, REST connectors, and client drivers. The issue is resolved in version 3.4.1.14.
Affected products
- taosdata TDengine < 3.4.1.14
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published by vendor
- 2026-07-15: disclosed: NVD publication date
- 2026-07-15: patched: Fix confirmed in version 3.4.1.14