CVE-2026-40006
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Apache IoTDB with AirGap mode enabled (pipe_air_gap_receiver_enabled=true), the pipe receiver accepts unauthenticated TCP connections on port 9780. An attacker can send a controlled 32-bit integer used as memory allocation size without an upper bound, causing JVM heap exhaustion and crashing the DataNode process.
Risk Assessment
An unauthenticated attacker can remotely crash or severely degrade the IoTDB server, disrupting time-series data monitoring and analysis systems.
Recommendation
Upgrade Apache IoTDB to version 2.0.10 or later immediately, which includes a fix limiting the maximum memory allocation size.
Other vulnerabilities in Apache IoTDB
See all- CVE-2026-40008Critical
A vulnerability in Apache IoTDB allows remote code execution through unsafe reflection. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting.
- CVE-2026-40005Critical
A Path Traversal vulnerability was found in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions using an unsafe API.
- CVE-2026-28564Critical
In Apache IoTDB, a vulnerability was found due to insufficient session expiration and authentication bypass via capture-replay attack. REST Basic Authentication accepts stale cached credentials.
- CVE-2026-24014Critical
The internal RPC interface of Apache IoTDB DataNode for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.
- CVE-2026-24013Critical
An authentication bypass vulnerability via spoofing has been found in Apache IoTDB. Thrift RPC query handlers do not properly validate the sessionId parameter, allowing an attacker to forge requests and receive query results without authentication. Affected versions are from 1.3.3 before 2.0.8.
- CVE-2025-64152Critical
A path traversal vulnerability has been discovered in Apache IoTDB, allowing access to files outside the restricted directory. The issue affects versions from 1.0.0 to 1.3.5 and from 2.0.0 to 2.0.6.
- CVE-2025-55017Critical
A Path Traversal vulnerability has been discovered in Apache IoTDB, allowing bypass of file path restrictions. The issue affects versions from 2.0.0 before 2.0.6 and from 1.0.0 before 1.3.6.
- CVE-2026-44630High
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Affects versions before 1.3.8 and from 2.0.0 before 2.0.9. Users are recommended to upgrade to version 2.0.10.
- CVE-2026-40452High
A vulnerability in Apache IoTDB allows unauthorized but authenticated users to access last-value data via the /rest/v2/fastLastQuery endpoint. The issue is caused by incorrect authorization and improper access control.
- CVE-2026-40009Medium
An improper privilege management and access control vulnerability exists in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor.
Original NVD description (English source)
Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no authentication. The readLength method reads an attacker-controlled 32-bit integer from the socket and readData passes it directly to new byte[length] with no upper-bound check. An unauthenticated attacker can cause the JVM to attempt an allocation of up to 2,147,483,647 bytes per connection, exhausting heap memory and crashing or severely degrading the DataNode process. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.