Unsafe Reflection

Apache IoTDB is vulnerable to Unsafe Reflection. The vulnerability is due to the pipe processor instantiating an externally supplied class name using Class.forName.newInstance without validation or allowlisting, allowing an attacker to instantiate arbitrary classes...

Path Traversal

Apache IoTDB is vulnerable to Path Traversal. The vulnerability is due to improper limitation of a pathname to a restricted directory, where the application fails to properly validate file path inputs and attackers can supply crafted path sequences to read or write files outside the intended...

Denial Of Service (DoS)

Apache IoTDB is vulnerable to Denial Of Service DoS.The vulnerability is due to missing authentication and insufficient validation of attacker-controlled allocation sizes in the AirGap receiver, allowing unauthenticated attackers to trigger excessive memory allocation and exhaust JVM heap memory,...

Denial Of Service (DoS)

Apache IoTDB is vulnerable to Denial Of Service DoS. The vulnerability is due to uncontrolled recursion in the AirGap receiver's readLength method, where repeated E-language prefixes trigger unbounded recursive calls, allowing unauthenticated attackers to exhaust the JVM stack and cause a...

Authorization Bypass

Apache IoTDB is vulnerable to Authorization Bypass. The vulnerability is due to insufficient authorization checks in the /rest/v2/fastLastQuery endpoint, allowing authenticated users to bypass access controls and retrieve last-value query results they are not authorized to access...

CVE-2026-44630

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

CVE-2026-44630 Apache IoTDB: RPC service denial of service via unchecked Thrift string length

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

org.apache.iotdb:client-example (>=2.0.1-beta, <=2.0.7), org.apache.iotdb:collector-core (2.0.3) +32 more potentially affected by CVE-2026-44630 via org.apache.iotdb:service-rpc (>=2.0.1-beta, <=2.0.8)

org.apache.iotdb:service-rpc MAVEN version =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.1-beta, =2.0.7 - org.apache.iotdb:iotdb-spring-boot-starter 2.0.3 and more Source cves: CVE-2026-44630 Source advisory: MEND:CVE-2026-44630...

CVE-2026-44630

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

CVE-2026-44630

The Apache IoTDB RPC service is vulnerable to a denial of service (DoS) due to improper validation of length fields. A remote unauthenticated attacker can send a crafted malformed Thrift frame , forcing the system to allocate excessive memory and crash with an OutOfMemoryError . This issue affect...

CVE-2026-44630 Apache IoTDB: RPC service denial of service via unchecked Thrift string length

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

PT-2026-69424

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions prior to 1.3.8 Apache IoTDB versions 2.0.0 through 2.0.8 Description Improper validation of length fields in the RPC service allows a remote unauthenticated attacker to cause a denial of service. By sending a crafted...

CVE-2026-44630: Memory Allocation with Excessive Size Value

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

Apache IoTDB authorization issue vulnerability (CNVD-2026-28234)

Apache IoTDB is an open-source IoT database developed by the Apache Foundation in the United States. Versions of Apache IoTDB from 1.3.3 to 2.0.8 contained an authorization vulnerability. This vulnerability stemmed from the lack of strict validation of the sessionId parameter by certain Thrift RP...

Insufficient Session Expiration

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to Insufficient Session Expiration in the AuthorizationFilter of the...

org.apache.iotdb:customize-mqtt-example (>=1.0.0, <=2.0.1-beta), org.apache.iotdb:influxdb-protocol (>=1.0.0, <=1.1.2) +13 more potentially affected by CVE-2026-28564 via org.apache.iotdb:iotdb-server (>=1.0.0, <=2.0.8)

org.apache.iotdb:iotdb-server MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.3.3, =1.0.0, =1.0.0, =1.3.3, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.3.3 Source cves: CVE-2026-28564 Source advisory: SNYK:JAVA-ORGAPACHEIOTDB-18021390...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in fastLastQuery of the /rest/v2/fastLastQuery endpoint. An attacker can access last-value data belonging to other users by sending crafted requests while authenticated, bypassing intended authorization controls...

Unsafe Reflection

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to Unsafe Reflection in the pipe processor, which reads a fully...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via the readLength function. An attacker can exhaust the receiver thread's JVM stack and cause a StackOverflowError by sending a stream of repeated E-language prefixes to the socket, resulting in unbounded...

org.apache.iotdb:iotdb-cli (2.0.8), org.apache.iotdb:iotdb-confignode (2.0.8) +4 more potentially affected by CVE-2026-40009 via org.apache.iotdb:node-commons (2.0.8)

org.apache.iotdb:node-commons MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.iotdb:node-commons and may be impacted: - org.apache.iotdb:iotdb-cli 2.0.8 - org.apache.iotdb:iotdb-confignode 2.0.8 -...