CVE-2026-62351

Executive Summary

CVE-2026-62351 is a critical vulnerability in TDengine, a time-series database optimized for IoT devices. The flaw resides in the transDecompressMsg() function within source/libs/transport/src/transComm.c. When pHead->comp == 1, the function reads STransCompMsg.contLen without first validating that the RPC packet contains the required 8-byte STransCompMsg structure. This leads to an unauthenticated out-of-bounds read, uncontrolled memory allocation, integer underflow, and ultimately a server crash. The vulnerability has a CVSS score of 7.5 (High) and affects all versions prior to 3.4.1.15. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the TDengine database server, which is typically deployed as a binary or containerized service.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The vulnerability is remotely exploitable without authentication, making it a significant threat to availability. An attacker can crash the server by sending a specially crafted RPC packet, leading to denial of service.

Deep Dive & Mechanics

The vulnerability is in the transDecompressMsg() function in source/libs/transport/src/transComm.c. The function processes RPC packets and handles decompression when pHead->comp == 1. The code reads STransCompMsg.contLen from the packet without verifying that the packet is large enough to contain the 8-byte STransCompMsg structure. This results in:

1. Out-of-bounds Read: Reading beyond the allocated packet buffer.
2. Uncontrolled Allocation: Using the out-of-bounds value for memory allocation, potentially leading to excessive memory consumption.
3. Integer Underflow: Arithmetic operations on the out-of-bounds value can cause underflows.
4. Server Crash: The combination of these issues leads to a denial of service.

The root cause is the lack of a length check before accessing the STransCompMsg structure. The fix in version 3.4.1.15 likely adds a validation to ensure the packet contains at least 8 bytes before reading contLen.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 3.4.1.15):

// In transDecompressMsg()
if (pHead->comp == 1) {
    STransCompMsg *pComp = (STransCompMsg *)(pHead + 1);
    int32_t contLen = pComp->contLen;  // No length check
    // ... use contLen for allocation and decompression
}

Patched Code (3.4.1.15 and later):

// In transDecompressMsg()
if (pHead->comp == 1) {
    if (pHead->contLen < sizeof(STransCompMsg)) {
        // Handle error: packet too small
        return -1;
    }
    STransCompMsg *pComp = (STransCompMsg *)(pHead + 1);
    int32_t contLen = pComp->contLen;
    // ... safe allocation and decompression
}

The patch adds a check to ensure the packet length is sufficient to contain the STransCompMsg structure before accessing its fields.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable TDengine server (version < 3.4.1.15) running on a network-accessible host.
• Ability to send raw TCP packets to the server's RPC port (default 6030).

Exploitation Steps:

1. Craft a malicious RPC packet with pHead->comp = 1 and a small contLen value that does not include the full STransCompMsg structure.
2. Send the packet to the target server.
3. The server will attempt to read STransCompMsg.contLen from an out-of-bounds location, leading to a crash.

Example Python Script (Conceptual):

import socket

def exploit(target_ip, target_port=6030):
    # Craft a minimal RPC packet with comp=1 and insufficient length
    # This is a simplified example; actual packet structure may vary
    packet = b'\x01'  # pHead->comp = 1
    packet += b'\x00' * 7  # Padding to simulate small packet
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    sock.send(packet)
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for malformed RPC packets with comp=1 and unusually small sizes.
• Use network intrusion detection systems (NIDS) to flag packets that do not meet expected structure lengths.

Mitigation:

• Immediately upgrade to TDengine version 3.4.1.15 or later.
• If upgrade is not possible, restrict network access to the TDengine server using firewalls or network segmentation.
• Implement rate limiting and anomaly detection on the RPC port.

Indicators of Compromise (IOCs)

• Network Traffic: RPC packets with comp=1 flag and payload size less than 8 bytes.
• Logs: Server crash logs showing segmentation faults or out-of-bounds read errors in transDecompressMsg().
• Memory: Uncontrolled memory allocation leading to high memory usage before crash.

Detection Engineering

YARA Rule

rule CVE_2026_62351_TDengine_RPC_Decompress {
    meta:
        description = "Detects malformed RPC packets targeting CVE-2026-62351 in TDengine"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-62351"
    strings:
        $comp_flag = { 01 }  // pHead->comp == 1
        $small_packet = { 00 00 00 00 00 00 00 }  // Packet less than 8 bytes
    condition:
        $comp_flag at 0 and #small_packet > 0
}

Sigma Rule

title: CVE-2026-62351 TDengine RPC Decompression Crash
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic attempting to exploit CVE-2026-62351 in TDengine
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        - payload: "|01|"  # pHead->comp == 1
        - payload_length: "< 8"
    condition: selection
falsepositives:
    - Legitimate small RPC packets (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 6030 (msg:"CVE-2026-62351 TDengine RPC Decompression Attempt"; flow:to_server; content:"|01|"; offset:0; depth:1; byte_test:1,<,8,1; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade TDengine to version 3.4.1.15 or later.
2. Network Segmentation: Restrict access to the TDengine RPC port (6030) to trusted IP addresses only.
3. Firewall Rules: Block inbound traffic to port 6030 from untrusted networks.
4. Monitoring: Enable logging and monitoring for unusual RPC packets or server crashes.
5. Backup: Ensure regular backups of TDengine data to facilitate recovery in case of a crash.

Valters IT
Securing Digital Frontiers