CVE-2023-38502

MEDIUM

TDengine < 3.0.7.1 - Denial of Service via UDF Nested Query

Title source: llm
STIX 2.1

Description

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue.

References (1)

Core 1
Core References

Scores

CVSS v3 6.5
EPSS 0.0056
EPSS Percentile 42.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-20
Status published
Products (1)
tdengine/tdengine < 3.0.7.1
Published Jul 25, 2023
Tracked Since Feb 18, 2026