CVE-2026-24012
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
An uncontrolled resource consumption vulnerability exists in Apache IoTDB. Some interfaces fail to impose reasonable limits on the time span and aggregation interval of queries, allowing an attacker to craft a request with extreme parameters, leading to Java heap exhaustion and DataNode crash.
Risk Assessment
An attacker can crash the DataNode, causing disruption of IoTDB services and potential loss of availability for time-series data processing.
Recommendation
Upgrade Apache IoTDB to version 2.0.8 immediately, which fixes this vulnerability.
Original NVD description (English source)
Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.