CVE-2026-62353

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp
https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) TDengine es una base de datos de series temporales optimizada para dispositivos de internet de las cosas. Antes de la versión 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incrementaba más allá de una barra invertida final en un literal de cadena SQL como ’abc\’ y leía un byte más allá del terminador nulo, permitiendo a un usuario autenticado que puede enviar consultas SQL bloquear el servidor y posiblemente filtrar memoria adyacente. Este problema está solucionado en la versión 3.4.1.14.

Information

Published : 2026-07-15 19:18

Updated : 2026-10-24 21:10

NVD link : CVE-2026-62353

Mitre link : CVE-2026-62353

CVE.ORG link : CVE-2026-62353

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

CWE-126

Buffer Over-read

{"id": "CVE-2026-62353", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62353", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T19:28:48.516815Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "taosdata", "product": "TDengine", "versions": [{"status": "affected", "version": "< 3.4.1.14"}]}]}], "published": "2026-07-15T19:18:38.073", "references": [{"url": "https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp", "source": "security-advisories@github.com"}, {"url": "https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-126"}]}], "descriptions": [{"lang": "en", "value": "TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14."}, {"lang": "es", "value": "TDengine es una base de datos de series temporales optimizada para dispositivos de internet de las cosas. Antes de la versi\u00f3n 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incrementaba m\u00e1s all\u00e1 de una barra invertida final en un literal de cadena SQL como \u2019abc\\\u2019 y le\u00eda un byte m\u00e1s all\u00e1 del terminador nulo, permitiendo a un usuario autenticado que puede enviar consultas SQL bloquear el servidor y posiblemente filtrar memoria adyacente. Este problema est\u00e1 solucionado en la versi\u00f3n 3.4.1.14."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "security-advisories@github.com"}