CVE-2026-62351 Overview
CVE-2026-62351 affects TDengine, a time-series database optimized for Internet of Things (IoT) deployments. Versions prior to 3.4.1.15 contain an unauthenticated out-of-bounds read in the RPC transport layer. The function transDecompressMsg() in source/libs/transport/src/transComm.c reads STransCompMsg.contLen when pHead->comp == 1 without verifying that the packet contains the 8-byte STransCompMsg structure. Remote attackers can trigger uncontrolled allocation, integer underflow, and a server crash by sending crafted RPC packets. The issue is fixed in TDengine 3.4.1.15.
Critical Impact
Unauthenticated remote attackers can crash TDengine servers over the network, disrupting time-series data ingestion and IoT workloads.
Affected Products
- TDengine versions prior to 3.4.1.15
- TDengine RPC transport layer (source/libs/transport/src/transComm.c)
- Deployments exposing TDengine RPC endpoints to untrusted networks
Discovery Timeline
- 2026-07-15 - CVE-2026-62351 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-62351
Vulnerability Analysis
The flaw resides in transDecompressMsg(), which handles compressed RPC messages in TDengine. When the message header field pHead->comp equals 1, the function interprets the payload as beginning with an 8-byte STransCompMsg structure and dereferences the contLen field. The code performs this read without validating that the received packet actually contains those 8 bytes.
An attacker who sends an undersized RPC packet with the compression flag set forces the parser to read beyond the packet buffer. The out-of-bounds value read from contLen is then used to compute a subsequent allocation size. A small or attacker-influenced value produces an integer underflow, resulting in an uncontrolled allocation request and a server crash. This condition is classified under [CWE-125] Out-of-Bounds Read.
Root Cause
The root cause is missing length validation before structure interpretation. The code path assumes packet integrity based on the header compression flag rather than verifying that the on-the-wire payload meets the minimum size required by sizeof(STransCompMsg). Trusting attacker-controlled header fields without bounds checks is the underlying defect.
Attack Vector
Exploitation requires only network access to a TDengine RPC listener. No authentication or user interaction is needed. An attacker crafts an RPC packet with pHead->comp set to 1 and a truncated body, then delivers it to the exposed port. The server reads memory outside the packet buffer, triggers an integer underflow when computing the decompression buffer size, and terminates.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-8pc4-p252-f5m7 for the upstream technical description.
Detection Methods for CVE-2026-62351
Indicators of Compromise
- Unexpected taosd process crashes or restarts correlated with inbound RPC traffic
- Core dumps referencing transDecompressMsg or transComm.c in the stack trace
- Malformed or truncated RPC packets with the compression flag set arriving at TDengine listeners
- Repeated short-lived TCP connections to TDengine RPC ports from a single source
Detection Strategies
- Monitor TDengine service logs for abnormal termination and repeated restart cycles
- Inspect network telemetry for undersized packets destined for TDengine RPC ports
- Alert on segmentation faults or allocation failures in taosd process telemetry
- Correlate crash events with source IP addresses to identify potential probing
Monitoring Recommendations
- Enable process crash telemetry and forward taosd events to a centralized SIEM
- Baseline normal RPC packet sizes and flag anomalous compressed messages below the expected minimum
- Track TDengine version inventory across the environment to identify unpatched hosts
- Monitor availability metrics for time-series ingestion pipelines dependent on TDengine
How to Mitigate CVE-2026-62351
Immediate Actions Required
- Upgrade all TDengine installations to version 3.4.1.15 or later
- Restrict network access to TDengine RPC ports using firewall rules or security groups
- Place TDengine behind authenticated network boundaries and remove exposure to the public internet
- Audit logs and crash records for evidence of prior exploitation attempts
Patch Information
The vendor fixed the issue in TDengine 3.4.1.15 by validating packet length before dereferencing the STransCompMsg structure in transDecompressMsg(). Deploy the patched release from the official TDengine repository. See the GitHub Security Advisory GHSA-8pc4-p252-f5m7 for release details.
Workarounds
- Block inbound access to TDengine RPC ports from untrusted networks until patching completes
- Terminate RPC connections at an authenticated reverse proxy or VPN layer
- Apply strict allowlists limiting which client IP addresses can reach the TDengine service
- Enable automatic service restart to reduce downtime while remediation is in progress
# Configuration example: restrict TDengine RPC port access with iptables
iptables -A INPUT -p tcp --dport 6030 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 6030 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
