EUVD-2026-44770Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable transport parsing bug with a single crafted packet (AV:N/AC:L/PR:N/UI:N); impact is a server crash only, so C:N/I:N/A:H.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg() read STransCompMsg.contLen when pHead->comp == 1 without first validating that the RPC packet contained the 8-byte STransCompMsg structure, causing an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server crash. This issue is fixed in version 3.4.1.15.
AnalysisAI
Denial of service in TDengine time-series database versions prior to 3.4.1.15 allows unauthenticated remote attackers to crash the server by sending a malformed compressed RPC packet. The transDecompressMsg() function trusts a compression-length field without verifying the packet is large enough to contain the 8-byte STransCompMsg header, leading to an out-of-bounds read, uncontrolled/underflowed allocation, and process crash. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; a vendor fix exists in 3.4.1.15.
Technical ContextAI
TDengine is a purpose-built time-series database widely used for IoT, industrial, and telemetry workloads, exposing a custom RPC transport for client and cluster communication. The defect lives in source/libs/transport/src/transComm.c, where transDecompressMsg() handles messages flagged as compressed (pHead->comp == 1). The code reads STransCompMsg.contLen directly from the wire before confirming the received buffer actually holds the fixed 8-byte STransCompMsg structure. This is a classic CWE-125 out-of-bounds read: the length/offset used to interpret the buffer is attacker-influenced and unvalidated. Because contLen is then used to size an allocation and compute an offset, the same untrusted read cascades into an uncontrolled allocation and an integer underflow, ultimately dereferencing memory outside the packet bounds and crashing the server process.
RemediationAI
Vendor-released patch: upgrade TDengine to version 3.4.1.15 or later, which adds validation that the RPC packet contains the full 8-byte STransCompMsg structure before reading contLen. As a compensating control until patching, restrict network access to the TDengine RPC/service ports (default 6030 and related taosd ports) using host or network firewalls so only trusted application hosts and cluster peers can reach them, and place TDengine behind a private network segment or VPN rather than exposing it to untrusted networks; note this does not stop an attacker who already has network reachability, so it is a stopgap, not a fix. Follow guidance in the vendor advisory GHSA-8pc4-p252-f5m7 (https://github.com/taosdata/TDengine/security/advisories/GHSA-8pc4-p252-f5m7).
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today