New flaw in TDengine database allows unauthenticated attackers to crash servers

As reported by Dark Reading, a vulnerability, CVE-2026-42542, has been discovered in TDengine, an open-source time-series database widely used in industrial and Internet of Things (IoT) environments. This flaw, discovered by Ridge Security researchers, could allow unauthenticated attackers to remotely crash vulnerable servers with a single, specially crafted network packet.

The vulnerability, an integer-underflow bug in the database's pre-authentication message parsing, affects TDengine versions 3.4.0.0 through 3.4.1.5. Attackers can exploit this by sending a malformed packet to TCP port 6030, the database's default RPC port, without needing credentials. Successful exploitation results in a denial-of-service condition, potentially causing significant disruptions in sectors like manufacturing, energy, automotive, and IoT.

TDengine has released version 3.4.1.6 to address the issue. While no attacks have been observed in the wild, researchers warn that the ease of exploitation makes it a target. Organizations are advised to upgrade to the patched version or restrict network access to port 6030 if an immediate upgrade is not feasible.

Source: Dark Reading