EUVD-2026-44771Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Server crash warrants A:H over vendor-assigned A:L; PR:L confirmed by authentication requirement; C:L for single adjacent byte read.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14.
AnalysisAI
Out-of-bounds read in TDengine's SQL tokenizer (versions prior to 3.4.1.14) allows an authenticated user with SQL query access to crash the database server and potentially leak one byte of adjacent heap memory. The flaw resides in tGetToken() within source/libs/parser/src/parTokenizer.c, triggered by submitting a SQL string literal ending in a bare backslash (e.g., 'abc\). No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
TDengine is a time-series database designed for IoT workloads, identifiable via the affected CPE under taosdata/TDengine prior to 3.4.1.14. The vulnerability is rooted in CWE-125 (Out-of-bounds Read): the SQL tokenizer function tGetToken() in source/libs/parser/src/parTokenizer.c fails to correctly handle a trailing backslash inside a quoted SQL string literal. When the parser encounters a backslash as the last character before the null terminator in a string such as 'abc\, it treats the backslash as an escape prefix and blindly increments the read pointer by one additional byte, reading past the end of the allocated buffer into adjacent memory. This is a classic off-by-one read at the null boundary, not a write primitive. The tags 'Buffer Overflow' and 'Information Disclosure' align with the read-past-boundary behavior: the overread can return adjacent heap content and, depending on memory layout, dereference unmapped memory and cause a process crash.
RemediationAI
Upgrade TDengine to version 3.4.1.14 or later, which resolves the off-by-one read in tGetToken() as confirmed by the vendor's GitHub Security Advisory GHSA-5r9p-3j4f-gmgp (https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp). If an immediate upgrade is not possible, restrict SQL query access to only fully trusted, individually authorized accounts rather than shared service credentials, reducing the blast radius if any account is compromised. Additionally, deploy a WAF or query proxy that validates SQL string literals and rejects inputs containing unterminated escape sequences (trailing backslash before closing quote) - note that this requires application-layer inspection and may impact legitimate query patterns depending on your workload. There are no other vendor-documented workarounds at time of analysis.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today