Unsafe Reflection

Apache IoTDB is vulnerable to Unsafe Reflection. The vulnerability is due to the pipe processor instantiating an externally supplied class name using Class.forName.newInstance without validation or allowlisting, allowing an attacker to instantiate arbitrary classes...

Path Traversal

Apache IoTDB is vulnerable to Path Traversal. The vulnerability is due to improper limitation of a pathname to a restricted directory, where the application fails to properly validate file path inputs and attackers can supply crafted path sequences to read or write files outside the intended...

Denial Of Service (DoS)

Apache IoTDB is vulnerable to Denial Of Service DoS.The vulnerability is due to missing authentication and insufficient validation of attacker-controlled allocation sizes in the AirGap receiver, allowing unauthenticated attackers to trigger excessive memory allocation and exhaust JVM heap memory,...

Denial Of Service (DoS)

Apache IoTDB is vulnerable to Denial Of Service DoS. The vulnerability is due to uncontrolled recursion in the AirGap receiver's readLength method, where repeated E-language prefixes trigger unbounded recursive calls, allowing unauthenticated attackers to exhaust the JVM stack and cause a...

Authorization Bypass

Apache IoTDB is vulnerable to Authorization Bypass. The vulnerability is due to insufficient authorization checks in the /rest/v2/fastLastQuery endpoint, allowing authenticated users to bypass access controls and retrieve last-value query results they are not authorized to access...

CVE-2026-44630 Apache IoTDB: RPC service denial of service via unchecked Thrift string length

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

org.apache.iotdb:client-example (>=2.0.1-beta, <=2.0.7), org.apache.iotdb:collector-core (2.0.3) +32 more potentially affected by CVE-2026-44630 via org.apache.iotdb:service-rpc (>=2.0.1-beta, <=2.0.8)

org.apache.iotdb:service-rpc MAVEN version =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.7 - org.apache.iotdb:iotdb-spring-boot-starter 2.0.3 and more Source cves: CVE-2026-44630 Source advisory: MEND:CVE-2026-44630...

CVE-2026-44630

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

CVE-2026-44630 Apache IoTDB: RPC service denial of service via unchecked Thrift string length

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

CVE-2026-44630: Memory Allocation with Excessive Size Value

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

PT-2026-69424

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions prior to 1.3.8 Apache IoTDB versions 2.0.0 through 2.0.8 Description Improper validation of length fields in the RPC service allows a remote unauthenticated attacker to cause a denial of service. By sending a crafted...

Apache IoTDB authorization issue vulnerability (CNVD-2026-28234)

Apache IoTDB is an open-source IoT database developed by the Apache Foundation in the United States. Versions of Apache IoTDB from 1.3.3 to 2.0.8 contained an authorization vulnerability. This vulnerability stemmed from the lack of strict validation of the sessionId parameter by certain Thrift RP...

org.apache.iotdb:customize-mqtt-example (>=1.0.0, <=2.0.1-beta), org.apache.iotdb:influxdb-protocol (>=1.0.0, <=1.1.2) +13 more potentially affected by CVE-2026-28564 via org.apache.iotdb:iotdb-server (>=1.0.0, <=2.0.8)

org.apache.iotdb:iotdb-server MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.3.3, =1.0.0, =1.0.0, =1.3.3, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.3.3 Source cves: CVE-2026-28564 Source advisory: SNYK:JAVA-ORGAPACHEIOTDB-18021390...

Unsafe Reflection

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to Unsafe Reflection in the pipe processor, which reads a fully...

org.apache.iotdb:iotdb-cli (2.0.8), org.apache.iotdb:iotdb-confignode (2.0.8) +4 more potentially affected by CVE-2026-40009 via org.apache.iotdb:node-commons (2.0.8)

org.apache.iotdb:node-commons MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.iotdb:node-commons and may be impacted: - org.apache.iotdb:iotdb-cli 2.0.8 - org.apache.iotdb:iotdb-confignode 2.0.8 -...

Improper Privilege Management

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to Improper Privilege Management in its user rename handling, which...

CVE-2026-40005

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to...

CVE-2026-40006

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipeairgapreceiverenabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no...

CVE-2026-40008

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName.newInstance without any validation or allowlisting. This issue affects Apache IoTDB:...

CVE-2026-40009

Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to internalauditor. This issue affects Apache IoTDB: from 2.0.8 before 2.0.10. Users are recommended to upgrade to version 2.0.10,...