CVE-2026-62353: taosdata TDengine out-of-bounds read in SQL lexer

CVE-2026-62353 · Severity: medium · CVSS 5.4 · Published 2026-07-15

TDengine is a high-performance database designed for Internet of Things (IoT) data. A security flaw in how the database processes SQL commands allows an authenticated user to crash the server or potentially view small amounts of sensitive memory by sending a specially crafted query. This could lead to service outages and minor data exposure in environments where users have query access.

Quick answers

Is CVE-2026-62353 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62353 being exploited in the wild.
How severe is CVE-2026-62353?
Medium severity, with a CVSS score of 5.4, published 15 July 2026.
Which products and versions are affected?
taosdata TDengine < 3.4.1.14.
Is there a fix for CVE-2026-62353?
A patch was published on 2026-07-15: Fix confirmed in version 3.4.1.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62353 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-62353?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in the SQL lexer of TDengine within the `tGetToken()` function in `parTokenizer.c`. The root cause is improper handling of escape characters; when a SQL string literal ends with a trailing backslash immediately before the null terminator (e.g., `'abc\`), the parser unconditionally increments the buffer index, causing it to read one byte beyond the allocated memory. An authenticated attacker with permissions to execute SQL queries can exploit this via the network to trigger a SIGSEGV crash or potentially leak adjacent memory. The vulnerability affects multiple entry points including the CLI, REST connectors, and client drivers. The issue is resolved in version 3.4.1.14.

Affected products

  • taosdata TDengine < 3.4.1.14

Timeline

  • 2026-06-26: advisory: GitHub Security Advisory published by vendor
  • 2026-07-15: disclosed: NVD publication date
  • 2026-07-15: patched: Fix confirmed in version 3.4.1.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.