CVE-2026-62353

Deferred Deferred - Pending Action

Buffer Overflow in TDengine SQL Parser

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-62353

EUVD

EUVD-2026-44771

Affected Vendors & Products

Vendor	Product	Version / Range
taosdata	tdengine	to 3.4.1.14 (exc)
taosdata	tdengine	to 3.4.1.13 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-126	The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-62353 is an authenticated out-of-bounds read in TDengine's SQL lexer function tGetToken(). It occurs when a SQL string literal ends with a backslash before the null terminator, causing the lexer to read one byte past the buffer's end. This leads to a denial-of-service crash and potential information leakage.

Detection Guidance

To detect this vulnerability, monitor TDengine server crashes when processing SQL queries with string literals ending in backslashes. Use AddressSanitizer during compilation to identify out-of-bounds reads. Check TDengine version; if below 3.4.1.14, the system is vulnerable.

Impact Analysis

An authenticated user can exploit this by submitting a malformed SQL query to crash the TDengine server via SIGSEGV. This causes a denial-of-service and may leak adjacent memory contents. The impact is limited to users with SQL query privileges.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's confidentiality requirements and HIPAA's safeguards for protected health information. A successful exploit may result in compliance breaches.

Mitigation Strategies

Upgrade TDengine to version 3.4.1.14 or later immediately. Restrict SQL query access to trusted authenticated users only. Apply input validation to block malformed queries with trailing backslashes in string literals.

Hi! I’m here to help you understand CVE-2026-62353. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70