CVE-2026-42542

TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single crafted RPC packet. No credentials or prior session state are required. Version 3.4.1.6 fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/taosdata/TDengine/releases/tag/ver-3.4.1.6	Product Release Notes
https://github.com/taosdata/TDengine/security/advisories/GHSA-vg95-j2hf-hvjx	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tdengine:tdengine:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-10 22:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-42542

Mitre link : CVE-2026-42542

CVE.ORG link : CVE-2026-42542

JSON object : View

Products Affected

tdengine

tdengine

CWE

CWE-191

Integer Underflow (Wrap or Wraparound)

{"id": "CVE-2026-42542", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42542", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T12:56:59.511171Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "taosdata", "product": "TDengine", "versions": [{"status": "affected", "version": ">= 3.4.0.0, < 3.4.1.6"}]}]}], "published": "2026-06-10T22:16:57.527", "references": [{"url": "https://github.com/taosdata/TDengine/releases/tag/ver-3.4.1.6", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/taosdata/TDengine/security/advisories/GHSA-vg95-j2hf-hvjx", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-191"}]}], "descriptions": [{"lang": "en", "value": "TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single crafted RPC packet. No credentials or prior session state are required. Version 3.4.1.6 fixes the issue."}, {"lang": "es", "value": "TDengine es una base de datos de series temporales de c\u00f3digo abierto optimizada para dispositivos de internet de las cosas. En las versiones 3.4.0.0 a 3.4.1.5, un atacante remoto no autenticado puede bloquear el proceso del servidor taosd enviando un \u00fanico paquete RPC manipulado. No se requieren credenciales ni estado de sesi\u00f3n previo. La versi\u00f3n 3.4.1.6 corrige el problema."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tdengine:tdengine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68C1A578-81A0-49AA-B839-CB445063929A", "versionEndExcluding": "3.4.1.6", "versionStartIncluding": "3.4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}