CVE-2026-42542 HIGH

CVE-2026-42542: TDengine has an integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS)

Vendor Taosdata
Product TDengine
Weakness CWE-191
Published June 10, 2026
Last update June 11, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single crafted RPC packet. No credentials or prior session state are required. Version 3.4.1.6 fixes the issue.

Key dates

02Disclosure timeline

June 10, 2026 CVE published
June 11, 2026 Record updated