CVE-2023-38502

TDengine Database Denial-of-Service

State: Published
Severity: 6.5 Medium
Published: Jul 25, 2023
Updated: Oct 10, 2024
Reserved: Jul 18, 2023

Description

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
TDenginetaosdata	< 3.0.7.1Affected

References

https://github.com/taosdata/TDengine/security/advisories/GHSA-w23f-r2fm-27hf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.