CVE-2026-42542: TDengine has an integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS)

Synopsis

An integer underflow in the uvConnMayGetUserInfo() function of TDengine, the open-source time-series database, allows an unauthenticated remote attacker to crash the taosd server process. The vulnerability is reachable over the network with no credentials and no user interaction required, by sending a single crafted RPC packet. Successful exploitation causes a full denial of service of the database process. No upstream fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the taosd RPC service over the network; the vulnerability is exposed to any host that can connect to the listening port.

• AuthenticationNot required

  No credentials or session state are needed; the crafted RPC packet can be sent before any authentication step.

• Victim interactionNot required

  No user or administrator action is needed to trigger the crash; the attacker acts entirely on their own.

• Attack complexityDetail

  Exploit complexity is low: the crash is triggered by a single crafted packet with no race conditions, memory-layout dependencies, or environmental preconditions.

Blast Radius

• The taosd server process crashes immediately on receipt of the crafted packet, taking the database offline.
• All connected clients lose their sessions and any in-flight queries or writes are dropped.
• Dependent services that rely on TDengine for time-series storage (IoT pipelines, monitoring systems, etc.) lose database connectivity until the process is manually or automatically restarted.