TDengine CVE-2026-42542: Unauthenticated Integer Underflow Crashes taosd with a Single Packet
1. Basic Information Original Title: One Packet Can Take Down the Database Behind Industrial Operations: Ridge Security Discovers CVE-2026-42542 Source: Ridge Security Published: September 23, 2026 Updated: None Severity: High Basis of Severity: A single unauthenticated packet sent to TCP/6030 can crash the database, and repeated transmission of crafted packets can sustain a restart loop and…
The vulnerability CVE-2026-42542 allows a single unauthenticated packet sent to TCP/6030 to crash the TDengine database. This is due to an integer underflow during processing, where the subtraction wraps around to a large value. This large length is then passed to memcpy, causing an out-of-bounds heap access and a crash. The crash can lead to a Denial of Service, with repeated successful attacks causing a restart loop and gaps in telemetry.
Although remote code execution has not been confirmed, the impact is high as it can cause missing data, application errors, and repeated automatic restarts. TDengine version 3.4.1.6 or later is recommended to mitigate this vulnerability, as updates to this version or later contain the fix.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.