CVE-2026-62353
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In TDengine before version 3.4.1.14, the tGetToken() function in the SQL parser mishandles string literals ending with a backslash, causing an out-of-bounds read. An authenticated user can submit a crafted SQL query to crash the server and potentially leak adjacent memory.
Risk Assessment
The organization is exposed to denial-of-service attacks and potential leakage of sensitive data from the database server memory, compromising confidentiality and availability.
Recommendation
Upgrade TDengine to version 3.4.1.14 or later immediately, which contains the fix for this vulnerability.
Other vulnerabilities in TDengine
See all- CVE-2026-62355Medium
In TDengine prior to version 3.4.1.15, a Data Reader user with admin_user role on a TDengine Cloud DB instance could execute create udf, even though standard users should have read-only permissions for non-database objects and commands like show dnodes and create user were denied.
- CVE-2026-62351High
In TDengine before version 3.4.1.15, the transDecompressMsg() function reads the STransCompMsg.contLen field without first validating that the RPC packet contains the 8-byte STransCompMsg structure, leading to an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server crash.
- CVE-2026-62350High
In TDengine prior to version 3.4.1.15, a user with create UDF privilege can upload a crafted shared library and install it as a user-defined function, then execute arbitrary C code on the server side through database queries.
- CVE-2026-62349High
In TDengine version 3.4.1.6 and earlier, the trimString() function in parUtil.c incorrectly checks string length before processing SQL escape sequences, leading to a one-byte out-of-bounds write to the stack buffer tmpTokenBuf. This can cause denial of service and potentially remote code execution.
- CVE-2026-62348Medium
In TDengine Enterprise before version 3.4.1.15, an authenticated low-privilege SQL user could run KILL SSMIGRATE <id> against an active shared-storage migration because the MND_OPER_SSMIGRATE_DB privilege check was commented out in mndProcessKillSsMigrateReq.
- CVE-2026-42542High
TDengine versions 3.4.0.0 through 3.4.1.5 allow an unauthenticated remote attacker to crash the taosd server process by sending a single crafted RPC packet. The issue is fixed in version 3.4.1.6.
Original NVD description (English source)
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14.