CVE-2023-38502: TDengine Database Denial-of-Service

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-25 · updated 2026-06-17
Weakness: CWE-20

Description

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue.

Affected products

taosdata TDengine: before 3.0.7.1 — fixed in 3.0.7.1

How to fix

Upgrade to a fixed version: taosdata TDengine 3.0.7.1. Check the vendor advisory for mitigations.

References

https://github.com/taosdata/TDengine/security/advisories/GHSA-w23f-r2fm-27hf
https://github.com/taosdata/TDengine/security/advisories/GHSA-w23f-r2fm-27hf

Get alerted when CVE-2023-38502 or the next vulnerability affects your stack