Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-42542

TDengine has an integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS)

Description

TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single crafted RPC packet. No credentials or prior session state are required. Version 3.4.1.6 fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

taosdata TDengine

  • >= 3.4.0.0, < 3.4.1.6affected

References