CVE-2026-40006

Apache IoTDB versions 1.0.0 before 2.0.10 are vulnerable to an unauthenticated heap-exhaustion Denial of Service (DoS) . When the pipe_air_gap_receiver_enabled parameter is set to true , the AirGap pipe receiver accepts raw TCP connections on port 9780 without authentication. The readLength metho...