CVE-2026-62353: medium-severity vulnerability in taosdata TDengine
TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.4%
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Affected products
taosdata · TDengineRelated CVEs — taosdata TDengine
In the same product, most dangerous first.
CVE-2023-38502MEDIUMTDengine Database Denial-of-ServiceEPSS 0.7%CVE-2026-42542HIGHTDengine has an integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS)EPSS 0.6%CVE-2026-62349HIGHTDengine: Off-by-One Buffer OverflowEPSS 0.5%CVE-2026-62350HIGHTDengine: UDF lead to RCEEPSS 0.5%CVE-2026-62351HIGHTDengine: Unauthenticated Remote Denial of Service via Out-of-Bounds Read in transDecompressMsgEPSS 0.4%CVE-2026-62348MEDIUMTDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrationsEPSS 0.3%