What is the CVSS score of CVE-2026-62351?

CVE-2026-62351 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of TDengine are affected by CVE-2026-62351?

High-severity denial-of-service vulnerability in TDengine (versions before 3.4.1.15) enables remote attackers to take down the database with a single malformed packet, requiring no authentication.. A patch is available.

How to fix or mitigate CVE-2026-62351?

Within 24 hours, identify and document all TDengine deployments in production, including their current versions. Within 7 days, apply the vendor patch by upgrading all TDengine installations to version 3.4.1.15 or later, beginning with production systems. Complete all upgrades organization-wide within 30 days, performing validation tests after each upgrade to confirm service stability.

TDengine CVE-2026-62351

EUVD-2026-44770 HIGH

Out-of-bounds Read (CWE-125)

2026-07-15 security-advisories@github.com

Buffer Overflow Information Disclosure

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable transport parsing bug with a single crafted packet (AV:N/AC:L/PR:N/UI:N); impact is a server crash only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Analysis Generated

Jul 15, 2026 - 19:32 vuln.today

CVE Published

Jul 15, 2026 - 19:18 cve.org

HIGH 7.5

DescriptionCVE.org

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg() read STransCompMsg.contLen when pHead->comp == 1 without first validating that the RPC packet contained the 8-byte STransCompMsg structure, causing an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server crash. This issue is fixed in version 3.4.1.15.

AnalysisAI

Denial of service in TDengine time-series database versions prior to 3.4.1.15 allows unauthenticated remote attackers to crash the server by sending a malformed compressed RPC packet. The transDecompressMsg() function trusts a compression-length field without verifying the packet is large enough to contain the 8-byte STransCompMsg header, leading to an out-of-bounds read, uncontrolled/underflowed allocation, and process crash. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; a vendor fix exists in 3.4.1.15.

Technical ContextAI

TDengine is a purpose-built time-series database widely used for IoT, industrial, and telemetry workloads, exposing a custom RPC transport for client and cluster communication. The defect lives in source/libs/transport/src/transComm.c, where transDecompressMsg() handles messages flagged as compressed (pHead->comp == 1). The code reads STransCompMsg.contLen directly from the wire before confirming the received buffer actually holds the fixed 8-byte STransCompMsg structure. This is a classic CWE-125 out-of-bounds read: the length/offset used to interpret the buffer is attacker-influenced and unvalidated. Because contLen is then used to size an allocation and compute an offset, the same untrusted read cascades into an uncontrolled allocation and an integer underflow, ultimately dereferencing memory outside the packet bounds and crashing the server process.

RemediationAI

Vendor-released patch: upgrade TDengine to version 3.4.1.15 or later, which adds validation that the RPC packet contains the full 8-byte STransCompMsg structure before reading contLen. As a compensating control until patching, restrict network access to the TDengine RPC/service ports (default 6030 and related taosd ports) using host or network firewalls so only trusted application hosts and cluster peers can reach them, and place TDengine behind a private network segment or VPN rather than exposing it to untrusted networks; note this does not stop an attacker who already has network reachability, so it is a stopgap, not a fix. Follow guidance in the vendor advisory GHSA-8pc4-p252-f5m7 (https://github.com/taosdata/TDengine/security/advisories/GHSA-8pc4-p252-f5m7).