CVE-2026-62351

7.5 Élevée

Publiée le 15/07/2026 à 21:18 · Modifiée le 15/07/2026 à 22:18 · Analyse NVD reportée · Source : security-advisories@github.com

Description

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg() read STransCompMsg.contLen when pHead->comp == 1 without first validating that the RPC packet contained the 8-byte STransCompMsg structure, causing an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server crash. This issue is fixed in version 3.4.1.15.

Traduire en français

Produits concernés

taosdata TDengine

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-125

Références

https://github.com/taosdata/TDengine/security/advisories/GHSA-8pc4-p252-f5m7
https://github.com/taosdata/TDengine/security/advisories/GHSA-8pc4-p252-f5m7

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories