TDengine CVE-2026-42542: Unauthenticated Integer Underflow Crashes taosd with a Single Packet

wpnews.pro

#

Basic Information

Original Title: One Packet Can Take Down the Database Behind Industrial Operations: Ridge Security Discovers CVE-2026-42542

- Source: Ridge Security
- Published: September 23, 2026
- Updated: None
- Severity: High

Basis of Severity: A single unauthenticated packet sent to TCP/6030 can crash the database, and repeated transmission of crafted packets can sustain a restart loop and telemetry gaps. The confirmed impact is a Denial of Service (DoS); remote code execution (RCE) and active exploitation have not been confirmed.
Original Article: One Packet Can Take Down the Database Behind Industrial Operations: Ridge Security Discovers CVE-2026-42542
Related Sources: TDengine Official Security Advisory ,GHSA-vg95-j2hf-hvjx
Revision Note: Separated the DoS verification results from unconfirmed RCE, and organized official affected/fixed versions, observable logs, and ATT&CK mapping.

In TDengine's unauthenticated RPC processing, the calculation subtracts both sizeof(STransMsgHead) and the required user-information offset from msgLen. If the message is too short, conversion to an unsigned type causes the subtraction to wrap around to a very large value. This extremely large length is passed to memcpy, causing an out-of-bounds heap access and abnormal termination of the taosd process.

#

Attack Flow

The validation and implementation paths identified in public sources are outlined below. For the scope of observation in real-world environments, refer to "Attack Success Determination."

Continuous DoS via Unauthenticated Packets

An attacker sends a crafted RPC message whose declared length is insufficient for the header and required user information.
Signed and unsigned subtraction in the unauthenticated parser wraps around into a large positive number.
memcpy accesses memory outside the allocated heap boundary, causing taosd to crash due to a segmentation fault.
Even if the service automatically restarts, the attacker continues to send packets to maintain a restart loop and telemetry gaps.

#

Attacker Positioning and Execution Location

The attacker is positioned on a network that can reach the TDengine RPC port. Internet exposure is not required; the attack can also originate from a compromised internal host that can reach the RPC port, particularly on a flat OT network.
The anomaly occurs during pre-authentication connection processing in the taosd process.

#

Victim and Administrator Perspective

Victims

Missing data or halted updates on monitoring screens, along with application connection errors, may occur.

Administrators

taosd segmentation faults, core dumps, repeated automatic restarts, and gaps in data ingestion serve as investigation clues.

#

Success and Failure Conditions

Success Conditions

Reachability to TCP/6030 of an unpatched TDengine instance.
The crafted header reaches the length calculation in uvConnMayGetUserInfo() .

Failure Conditions and Mitigations

Update to TDengine version 3.4.1.6 or later.
Keep TCP/6030 private from the internet and restrict network ACLs to authorized clients only.

#

Impact upon Success

Abnormal termination of taosd may lead to lost uncommitted writes, stopped data collection, or halted alerts. Repeated crashes via repeated transmission of crafted packets prolong the outage. This does not indicate the loss of durably committed data or code execution.

#

Observable Logs

The following items represent investigation viewpoints for organizations. They do not imply that every item was observed in an actual attack.

Email : No reports indicate email was used as an initial access vector. #

Proxy / SWG / DNS : Standard Web proxy or DNS logs alone cannot inspect the contents of TCP/6030 RPC requests. Correlate with network logs capable of capturing the target traffic. #

Endpoint / EDR : Identify taosd segmentation faults, core dumps, and restarts initiated by systemd. #

SaaS / Cloud : Check for data ingestion gaps and service state events in monitoring platforms. #

Network : If connections and packet capture for TCP/6030 are available, inspect msgLen and correlate with crash timestamps.

#

Attack Success Determination

Confirmed in Public Information

DoS Success Verified in Research Environments : Ridge Security verified that taosd can be stopped using crafted packets. Real-world exploitation and successful RCE have not been confirmed.

Organization-Specific Determination Criteria

Attack Attempt Observed (Success Unconfirmed) : Criteria: The observation of suspicious RPC requests alone does not constitute a successful DoS. It must be supported by a corresponding taosd abnormal termination and service outage matching the connection timestamp. While Ridge Security verified DoS success in a research environment, real-world exploitation remains unconfirmed. (Scope: Internal investigation criteria; distinct from research-environment DoS success).

#

Investigation Playbook

The following outlines an investigation and response plan for organizations based on public information:

Starting Point : Begin with taosd abnormal terminations, restart loops, and gaps in data ingestion. #

Initial Response : Verify whether TDengine versions 3.4.0.0 through 3.4.1.5 are in use and check the reachability scope to TCP/6030. #

Endpoint : Preserve taosd logs, core dumps, service restart records, and any available RPC communication records. #

Identity / Cloud : Check tokens, keys, logins, and SaaS/cloud audit logs. #

Follow-up Verification : Track repeated crashes after restart and missing ingested data. Judge RCE and credential theft based on separate evidence. #

Containment : Restrict RPC connections to authorized clients only and update to supported versions containing the fix in 3.4.1.6. Account for the impact of updates and restarts on monitoring outages. #

Outcome Classification : Distinguish suspicious connections, malformed requests, confirmed crashes, service outages, and any separately evidenced subsequent compromise.

#

Defense and Detection Ideas

Single Event : Detect taosd segmentation faults, core dumps, and abnormally frequent restarts. #

Timeline : Correlate connections to TCP/6030, taosd abnormal terminations, restarts, and data ingestion gaps. #

Hunting : Cross-reference the impact period with asset inventories to retroactively hunt for matching IoCs and behaviors. #

Logging Gaps : A lack of required logs limits the ability to determine success stages. The absence of logs alone does not confirm non-execution. #

Priority Actions : Prioritize patching, restricting inbound access to the RPC port, monitoring service availability, and retaining crash and network logs.

#

Facts / Inference / Hypothesis

Facts

TDengine versions 3.4.0.0 through 3.4.1.5 are affected, and the issue is resolved in 3.4.1.6.
TDengine's custom binary RPC protocol uses TCP/6030 by default, where the pre-authentication function uvConnMayGetUserInfo() subtracts an unsigned header/offset from a signed 32-bit integermsgLen supplied by the attacker.
The vulnerable calculation subtracts both sizeof(STransMsgHead) and the required user-information offset from msgLen. If the message is too short, conversion to an unsigned type causes the subtraction to wrap around to a very large value near 2^64 on 64-bit environments. This value is passed to the length argument of memcpy, causing out-of-bounds heap access and a segmentation fault.
The confirmed impact is an unauthenticated remote DoS. Even if the taosd process restarts, repeated transmission of crafted packets can sustain a crash loop.
Ridge Security has not confirmed real-world exploitation telemetry or published exploit code, and has not publicly released a PoC.

Inference

Heap corruption could theoretically be the subject of RCE research, but public evidence is limited to a stable DoS, making it impossible to conclude that RCE is feasible.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under "Unknowns and Additional Investigation."

#

MITRE ATT&CK Mapping

#

Unknowns and Additional Investigation

Whether active exploitation has occurred on the internet or inside OT networks.
Whether the heap corruption can be leveraged into code execution.
The number of unrecognized TDengine instances embedded within OEM products or appliances.

#

Impact on SOCs and Organizations

Organizations using TDengine in factories, energy systems, IoT, or vehicle telemetry should update to version 3.4.1.6 or later and restrict port 6030/TCP exclusively to authorized application hosts. SOCs should correlate these indicators by host and time, and investigate related events as a suspected DoS incident.

#

Audience-Specific Summary

SOC : Correlate 6030/TCP short connections, taosd segmentation faults, core dumps, restart loops, and data ingestion gaps. #

Administrators : Update to version 3.4.1.6 or later and restrict 6030/TCP to authorized clients via ACLs or host firewalls. #

Users : General user actions cannot prevent this issue. Report missing or halted monitoring dashboards to operations management.

source & further reading

dev.to — original article Shipping an MCP Server: Desktop App vs Hosted Web App Does a line in auto memory steer the next session like CLAUDE.md does? 3 of 4 runs vs 4 of 4, and 0 of 4 with neither Anthropic’s Claude Text Watermark: What It Means for SEO and Content Workflows