CVE-2026-42542

EUVD-2026-36136
TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single crafted RPC packet. No credentials or prior session state are required. Version 3.4.1.6 fixes the issue.
Wrap or Wraparound
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 42%
Affected Products (NVD)
VendorProductVersion
tdenginetdengine
3.4.0.0 ≤
𝑥
< 3.4.1.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/taosdata/TDengine/releases/tag/ver-3.4.1.6
https://github.com/taosdata/TDengine/security/advisories/GHSA-vg95-j2hf-hvjx