{"api_version":"1","generated_at":"2026-07-16T10:14:53+00:00","cve":"CVE-2026-62353","urls":{"html":"https://cve.report/CVE-2026-62353","api":"https://cve.report/api/cve/CVE-2026-62353.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-62353","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-62353"},"summary":{"title":"TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken","description":"TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-07-15 19:18:38","updated_at":"2026-07-15 20:18:01"},"problem_types":["CWE-125","CWE-126","CWE-125 CWE-125: Out-of-bounds Read","CWE-126 CWE-126: Buffer Over-read"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"5.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"}}],"references":[{"url":"https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp","name":"https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62353","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62353","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"taosdata","product":"TDengine","version":"affected < 3.4.1.14","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-62353","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-15T19:28:48.516815Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-07-15T19:28:51.733Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit"],"url":"https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"TDengine","vendor":"taosdata","versions":[{"status":"affected","version":"< 3.4.1.14"}]}],"descriptions":[{"lang":"en","value":"TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","description":"CWE-125: Out-of-bounds Read","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-126","description":"CWE-126: Buffer Over-read","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-15T19:08:55.160Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp","tags":["x_refsource_CONFIRM"],"url":"https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp"}],"source":{"advisory":"GHSA-5r9p-3j4f-gmgp","discovery":"UNKNOWN"},"title":"TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-62353","datePublished":"2026-07-15T19:08:55.160Z","dateReserved":"2026-07-13T21:42:50.096Z","dateUpdated":"2026-07-15T19:28:51.733Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-15 19:18:38","lastModifiedDate":"2026-07-15 20:18:01","problem_types":["CWE-125","CWE-126","CWE-125 CWE-125: Out-of-bounds Read","CWE-126 CWE-126: Buffer Over-read"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-15T19:28:48.516815Z","id":"CVE-2026-62353","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"62353","Ordinal":"1","Title":"TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToke","CVE":"CVE-2026-62353","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"62353","Ordinal":"1","NoteData":"TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14.","Type":"Description","Title":"TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToke"}]}}}