CVE-2026-42542 Overview
CVE-2026-42542 is a denial of service vulnerability in TDengine, an open source time-series database optimized for Internet of Things (IoT) workloads. The flaw allows an unauthenticated remote attacker to crash the taosd server process by sending a single crafted Remote Procedure Call (RPC) packet. No credentials, prior session state, or user interaction are required to trigger the condition. The issue affects TDengine versions 3.4.0.0 through 3.4.1.5 and is fixed in version 3.4.1.6. The underlying weakness is classified as an integer underflow [CWE-191] in the RPC packet handling path.
Critical Impact
A single unauthenticated network packet crashes the taosd database process, disrupting availability for all clients and downstream IoT pipelines.
Affected Products
- TDengine 3.4.0.0 through 3.4.1.5 (taosd server)
- IoT and time-series deployments exposing the TDengine RPC service
- Fixed in TDengine 3.4.1.6
Discovery Timeline
- 2026-06-10 - CVE-2026-42542 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-42542
Vulnerability Analysis
The vulnerability resides in the taosd server's RPC packet parsing logic. TDengine listens for client RPC traffic over the network and processes incoming messages before any authentication step completes. A crafted packet triggers an integer underflow during length or field calculations, leading to an unhandled condition that terminates the taosd process. Because the crash occurs pre-authentication, any host able to reach the TDengine RPC port can repeatedly disrupt the service. The result is loss of availability for the database and any application depending on its time-series queries or ingestion.
Root Cause
The root cause is an integer underflow [CWE-191] in the RPC message handler. Attacker-controlled fields in the packet header are used in arithmetic that produces a value below zero, which then wraps into a large unsigned value or fails a downstream sanity check. The server does not validate these fields before use, so processing the packet drives the process into an invalid state and terminates taosd.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends one specially crafted RPC packet to the TDengine listening port. The TDengine maintainers describe the impact in the GitHub Security Advisory GHSA-vg95-j2hf-hvjx and ship the fix in the TDengine 3.4.1.6 release. No proof-of-concept exploitation code is publicly listed in the references.
Detection Methods for CVE-2026-42542
Indicators of Compromise
- Unexpected termination of the taosd process followed by automatic or manual restart cycles.
- Inbound RPC connections to the TDengine port from untrusted source addresses immediately preceding a crash.
- Gaps in time-series ingestion or query availability that correlate with taosd restarts in system logs.
Detection Strategies
- Monitor process supervision logs (systemd, container orchestrators) for repeated taosd exit events.
- Inspect TDengine server logs for malformed RPC parsing errors or abrupt shutdowns without an admin-initiated stop.
- Apply network intrusion detection signatures on the TDengine RPC port to flag malformed packets from non-allowlisted sources.
Monitoring Recommendations
- Alert on taosd process restart frequency exceeding a baseline threshold.
- Track connection volume and source diversity on the TDengine RPC listening port.
- Correlate database availability metrics with network telemetry to identify external trigger sources.
How to Mitigate CVE-2026-42542
Immediate Actions Required
- Upgrade all TDengine deployments to version 3.4.1.6 or later as the authoritative fix.
- Restrict network access to the TDengine RPC port to known application servers using firewall or security group rules.
- Audit internet-exposed TDengine instances and remove direct public exposure where possible.
Patch Information
The vendor fix is delivered in the TDengine 3.4.1.6 release. Operators running 3.4.0.0 through 3.4.1.5 should plan an upgrade. Details on the affected versions and remediation are documented in the GitHub Security Advisory GHSA-vg95-j2hf-hvjx.
Workarounds
- Place TDengine behind a network allowlist so only trusted client subnets reach the RPC port.
- Deploy a process supervisor that restarts taosd automatically while upgrade planning is underway.
- Isolate TDengine in a dedicated network segment with rate limiting on inbound RPC connections.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
