# CVE-2026-42542: TDengine unauthenticated integer underflow lets a single RPC packet crash taosd

> An integer underflow (CWE-191) in uvConnMayGetUserInfo() in TDengine 3.4.0.0 through 3.4.1.5 lets an unauthenticated remote attacker crash the taosd server with one crafted RPC packet over TCP/6030, causing denial of service. Fixed in 3.4.1.6. Ridge Security reports no in-the-wild exploitation telemetry and no known public exploit code; CVE-2026-42542 is not in CISA KEV as of the 2026.09.27 catalog.

- **Published:** 2026-09-28T00:00:00Z
- **Last reviewed:** 2026-09-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2746
- **ID:** TL-2026-2746
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42542

## Description

CVE-2026-42542 is a pre-authentication integer underflow in the RPC transport layer of TDengine, an open-source distributed time-series database used for industrial telemetry, IoT, energy and utilities, connected-vehicle, EV-charging, telecom and building-automation data. The flaw is in uvConnMayGetUserInfo() at source/libs/transport/src/transSvr.c (line 860 per the vendor advisory) and affects TDengine 3.4.0.0 through 3.4.1.5. It was discovered by the Ridge Security Threat Research Team (Yan Zhou; the GitHub advisory credits discoverer Yan @ Ridge Security and reporter shook-zhou) while testing open-source applications used in IoT/OT environments.

Root cause: the function subtracts sizeof(STransMsgHead) plus a user-info offset from msgLen, a signed 32-bit integer (int32_t len) read directly from the attacker-controlled message header. Because sizeof(STransMsgHead) is an unsigned size_t, the signed value is promoted, and when msgLen is smaller than the header plus offset the subtraction wraps to a value near 2^64 on 64-bit systems (about 18 exabytes per the advisory). That value is passed to memcpy() as the copy length, producing an out-of-bounds heap access and a segmentation fault that terminates the taosd process. Ridge Security describes the fixed header as 64 or 192 bytes depending on message type; the advisory gives the required user-info offset as 24-128 bytes.

The vendor advisory documents the reproduction conditions: a malformed STransMsgHead with withUserInfo=1, version=3, and msgLen set to sizeof(STransMsgHead)+10 (too short for the required offset), carrying a valid CRC32 checksum. The CRC32 is a public, unkeyed integrity algorithm the sender computes, so it is not a barrier; no credentials, session state or user interaction are required, and the taosd RPC service listens on TCP/6030 by default. The vendor advisory and Ridge Security both state the confirmed impact is availability loss only; the advisory notes pre-crash heap memory corruption and that more sophisticated exploitation is conceivable, but no code-execution primitive has been demonstrated.

Exploitation status: Ridge Security states it has no telemetry indicating in-the-wild exploitation and is aware of no public exploit code. It holds a working proof of concept that reproduces the crash, withholds it from public release, and shares it with vetted defenders/vendors/CERTs under non-redistribution terms. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (version 2026.09.27, 1,728 entries), and third-party trackers put its EPSS score below 1% (OpenCVE 0.00633; Strix/CyberStrike 0.54%). Independent coverage describes the fix as a three-line guard around the subtraction. Repeated transmission of the packet can sustain an outage when a supervisor such as systemd restarts taosd (a 'permanent crash cycle'); consequences include lost uncommitted writes, halted data collection, and lost visibility or alerting in OT environments. Ridge Security's researcher warned that outages could serve as cover for secondary attacks. Highest risk is on flat networks where TCP/6030 is broadly reachable and in embedded/OEM appliances where operators may not know TDengine is present; industrial environments also face patch delays from maintenance windows and vendor support requirements.

Remediation: upgrade to TDengine 3.4.1.6 or later, which rejects the packet when withUserInfo is set and msgLen is shorter than sizeof(STransMsgHead)+offset, logging 'withUserInfo set but msgLen %d too short (need %d)' before any arithmetic is done (fix commit 003e8a5f102f6ee24ada79e087bdbbea1442ca88; introducing commit 6e95fe58a4e69509bd36aacbbc052ab264526942 per OSV). Until patched, restrict TCP/6030 with host firewalls or network ACLs to authorized application hosts, inventory all instances including bundled ones, and monitor for taosd segmentation faults, crash loops and ingestion gaps. Ridge Security also noted, separately from this CVE, that TDengine defaults to MD5 password hashing and SHA-1 RPC connection signatures. The same Ridge Security post discloses an unrelated low-severity NanoMQ issue (CVE-2026-44639, CVSS 3.7, O(N^2) MQTT v5 property decoding, fixed in 0.24.14).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T0819 Exploit Public-Facing Application
- T0814 Denial of Service

## Sources

- [Integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS) - GHSA-vg95-j2hf-hvjx](https://github.com/taosdata/TDengine/security/advisories/GHSA-vg95-j2hf-hvjx)
- [One Packet Can Take Down the Database Behind Industrial Operations: Ridge Security Discovers CVE-2026-42542](https://ridgesecurity.ai/blog/one-packet-can-take-down-the-database-behind-industrial-operations-ridge-security-discovers-cve-2026-42542/)
- [NVD - CVE-2026-42542](https://nvd.nist.gov/vuln/detail/CVE-2026-42542)
- [OSV - CVE-2026-42542 (GHSA-vg95-j2hf-hvjx)](https://osv.dev/vulnerability/CVE-2026-42542)
- [TDengine TSDB Docs - Security Advisories (TD-SEC-2026-001)](https://docs.tdengine.com/security-guide/security-advisories/)
- [TDengine release ver-3.4.1.6](https://github.com/taosdata/TDengine/releases/tag/ver-3.4.1.6)
- [OpenCVE - CVE-2026-42542 (EPSS, CPE, KEV status)](https://app.opencve.io/cve/CVE-2026-42542)
- [One Packet Can Crash OT Servers in Industrial Sectors (Dark Reading)](https://www.darkreading.com/ics-ot-security/one-packet-crash-servers-tdengine)
- [Security Boulevard: One Packet Can Take Down the Database Behind Industrial Operations](https://securityboulevard.com/2026/09/one-packet-can-take-down-the-database-behind-industrial-operations-ridge-security-discovers-cve-2026-42542/)
- [TDengine CVE-2026-42542: Unauthenticated Integer Underflow Crashes taosd with a Single Packet (DEV Community)](https://dev.to/anoymask/tdengine-cve-2026-42542-unauthenticated-integer-underflow-crashes-taosd-with-a-single-packet-38o9)
- [New OT zero-day can take down a database with one packet, and you may not know it's there (The IT Nerd)](https://itnerd.blog/2026/09/24/new-ot-zero-day-can-take-down-a-database-with-one-packet-and-you-may-not-know-its-there/)
- [CISA Known Exploited Vulnerabilities catalog (checked: no CVE-2026-42542 entry, version 2026.09.27)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2746