CVE-2026-42542: TDengine RPC Integer Underflow Denial of Service

Technical summary

The vulnerability stems from an integer underflow condition (CWE-191) in the TDengine RPC packet handling logic within affected versions. When a malicious RPC packet is received by the taosd daemon, the packet parsing logic fails to properly validate numeric boundaries, leading to an integer underflow that crashes the process. The attack surface is the unauthenticated RPC interface exposed on the network, and the lack of input validation or bounds checking allows a single crafted packet to trigger the crash without requiring authentication or a prior session.

Business impact

An attacker exploiting this vulnerability can deny service to any TDengine deployment running a vulnerable version. In production IoT environments where TDengine serves as the central time-series database, a crash of the taosd process immediately halts all data ingestion, queries, and downstream analytics dependent on that database. Recovery requires manual intervention to restart the service. For time-sensitive IoT applications (industrial monitoring, sensor telemetry, real-time analytics), even brief downtime can result in lost data, missed alerts, and operational disruption.

Affected systems

TDengine versions 3.4.0.0 through 3.4.1.5 are vulnerable. Version 3.4.1.6 and later contain the fix. Any deployment using TDengine in this version range—whether on-premises or cloud-hosted—is at risk if the taosd RPC interface is accessible from an untrusted network or the internet.

Exploitability

Exploitability is high. The attack requires no authentication, no prior knowledge of the target state, and no user interaction. A single network packet triggers the crash, making it trivial to automate. The barrier to exploitation is extremely low; an attacker with network access to the RPC port can launch the attack in seconds. However, the CVSS score reflects the impact (availability loss only, not confidentiality or integrity compromise).

Remediation

Upgrade TDengine to version 3.4.1.6 or later immediately. No workarounds exist short of restricting network access to the RPC interface via firewall rules or network segmentation. For organizations unable to patch immediately, isolate the taosd service behind a firewall and restrict RPC access to trusted internal networks only.

Patch guidance

Apply the patch by upgrading to TDengine version 3.4.1.6 or later. Consult the official TDengine release notes and vendor advisory for upgrade procedures specific to your deployment (clustered, single-node, containerized, etc.). Test the upgrade in a non-production environment first to ensure compatibility with your existing schemas and applications. Schedule the upgrade during a maintenance window, as restarting taosd will temporarily halt database operations.

Detection guidance

Monitor for unexpected taosd process crashes or restarts, particularly if they correlate with suspicious network traffic on the RPC port. Implement network-based IDS/IPS signatures to detect anomalous RPC packets destined for TDengine. Log all RPC connection attempts and monitor for sources sending packets to the taosd RPC port from unexpected IP addresses. After patching, verify version compliance via the TDengine version endpoint or package inventory tools.

Why prioritize this

This vulnerability merits high priority remediation due to the combination of zero-authentication access, trivial exploitability, and direct impact on availability in a critical infrastructure component. Although confidentiality and integrity are not affected, denial of service to a core database supporting IoT operations can cascade across dependent systems. The fix is straightforward (a version upgrade), and the attack is easily weaponized by any network-adjacent attacker.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the availability impact (A:H) combined with a low attack complexity (AC:L), no authentication requirement (PR:N), and network-based attack vector (AV:N). The score appropriately penalizes the ease of exploitation but does not award points for confidentiality or integrity loss, as the vulnerability only enables denial of service. In the context of a critical time-series database, the business risk often exceeds the base CVSS rating.

Frequently asked questions