CVEvulnerability

CVE-2026-62351

7.5 HIGH Published 2026-07-15 Modified 2026-10-24 Official page ↗
Status
Deferred
Published
2026-07-15
Last modified
2026-10-24
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-125

Description

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg() read STransCompMsg.contLen when pHead->comp == 1 without first validating that the RPC packet contained the 8-byte STransCompMsg structure, causing an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server crash. This issue is fixed in version 3.4.1.15.

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References