CVE-2026-62353: falha de média gravidade em taosdata TDengine
TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.4%
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Produtos afetados
taosdata · TDengineCVEs relacionadas — taosdata TDengine
No mesmo produto, das mais perigosas para as menos.
CVE-2023-38502MEDIUMTDengine Database Denial-of-ServiceEPSS 0.7%CVE-2026-42542HIGHTDengine has an integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS)EPSS 0.6%CVE-2026-62349HIGHTDengine: Off-by-One Buffer OverflowEPSS 0.5%CVE-2026-62350HIGHTDengine: UDF lead to RCEEPSS 0.5%CVE-2026-62351HIGHTDengine: Unauthenticated Remote Denial of Service via Out-of-Bounds Read in transDecompressMsgEPSS 0.4%CVE-2026-62348MEDIUMTDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrationsEPSS 0.3%