Patched TDengine Flaw Lets Unauthenticated Attackers Crash Servers With One Packet
Summary
CVE-2026-42542 is a high-severity pre-authentication flaw in TDengine versions 3.4.0.0–3.4.1.5 that can let network-accessible attackers crash servers. Version 3.4.1.6 fixes the issue; no in-the-wild attacks are known.
Key points
- The integer-underflow flaw occurs during pre-authentication message parsing and can be triggered with one specially crafted packet.
- An attacker needs network access to TCP port 6030, TDengine's default RPC port, but no credentials or established session.
- Affected versions are TDengine 3.4.0.0 through 3.4.1.5; fixed version 3.4.1.6 is available.
- The confirmed impact is denial of service through remote database crashes, potentially disrupting operational monitoring and creating gaps in telemetry.
- There is no evidence of exploitation in the wild or publicly available exploit code; Ridge Security developed a proof of concept but did not release it.
- Organizations should upgrade and restrict access to TCP port 6030; the article notes the patch has been available since April and TDengine published an advisory on June 4.
Article Details
- Vulnerability Types
- Integer underflow in pre-authentication message parsing
- Severity
- High (CVSS 7.5)
- Affected Versions
- TDengine 3.4.0.0 through 3.4.1.5
- Exploitation Status
- not_reported
- Exploit Availability
- claimed_or_private
- Patch Status
- available
- Workarounds
- Restrict access to TCP port 6030.
- Reduce network exposure to the affected service if an immediate upgrade is not possible.
MITRE ATT&CK
CVE
People
Vendors
Products
Industries
Automotiveaffects TDengine, a time-series database that organizations in sectors like manufacturing, energy, automotive, and IoT use to store and analyze large volumes of data collected over time. Examples of such dataconnected vehiclesThe impact could be particularly significant in industrial telemetry, IoT, energy and utilities, connected vehicles, and other operational environments, where losing access to the database can mean losing visibilityEnergyCVE-2026-42542 affects TDengine, a time-series database that organizations in sectors like manufacturing, energy, automotive, and IoT use to store and analyze large volumes of data collected over time. Examples of suchindustrial telemetryThe impact could be particularly significant in industrial telemetry, IoT, energy and utilities, connected vehicles, and other operational environments, where losing access to the database can mean losing visibilityIoTA now-patched flaw in an open source database used in industrial and Internet of Things (IoT) environments could let unauthenticated attackers crash vulnerable servers with a single specially crafted network packet ifManufacturingtracked as CVE-2026-42542 affects TDengine, a time-series database that organizations in sectors like manufacturing, energy, automotive, and IoT use to store and analyze large volumes of data collected over time.UtilitiesThe impact could be particularly significant in industrial telemetry, IoT, energy and utilities, connected vehicles, and other operational environments, where losing access to the database can mean losing visibility