CVE-2026-40007
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
An uncontrolled recursion and resource consumption vulnerability exists in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the AirGap receiver's readLength method recursively calls itself without depth limit upon recognizing the E-language prefix in socket data. An unauthenticated attacker can send a stream of repeated E-language prefixes, causing a JVM stack overflow and StackOverflowError.
Risk Assessment
An attacker can remotely crash the AirGap receiver thread, leading to denial of service (DoS) and potential loss of IoTDB system availability.
Recommendation
Upgrade Apache IoTDB to version 2.0.10 or later, which fixes the uncontrolled recursion issue.
Other vulnerabilities in Apache IoTDB
See all- CVE-2026-40008Critical
A vulnerability in Apache IoTDB allows remote code execution through unsafe reflection. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting.
- CVE-2026-40005Critical
A Path Traversal vulnerability was found in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions using an unsafe API.
- CVE-2026-28564Critical
In Apache IoTDB, a vulnerability was found due to insufficient session expiration and authentication bypass via capture-replay attack. REST Basic Authentication accepts stale cached credentials.
- CVE-2026-24014Critical
The internal RPC interface of Apache IoTDB DataNode for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.
- CVE-2026-24013Critical
An authentication bypass vulnerability via spoofing has been found in Apache IoTDB. Thrift RPC query handlers do not properly validate the sessionId parameter, allowing an attacker to forge requests and receive query results without authentication. Affected versions are from 1.3.3 before 2.0.8.
- CVE-2025-64152Critical
A path traversal vulnerability has been discovered in Apache IoTDB, allowing access to files outside the restricted directory. The issue affects versions from 1.0.0 to 1.3.5 and from 2.0.0 to 2.0.6.
- CVE-2025-55017Critical
A Path Traversal vulnerability has been discovered in Apache IoTDB, allowing bypass of file path restrictions. The issue affects versions from 2.0.0 before 2.0.6 and from 1.0.0 before 1.3.6.
- CVE-2026-44630High
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Affects versions before 1.3.8 and from 2.0.0 before 2.0.9. Users are recommended to upgrade to version 2.0.10.
- CVE-2026-40452High
A vulnerability in Apache IoTDB allows unauthorized but authenticated users to access last-value data via the /rest/v2/fastLastQuery endpoint. The issue is caused by incorrect authorization and improper access control.
- CVE-2026-40009Medium
An improper privilege management and access control vulnerability exists in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor.
Original NVD description (English source)
Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticated attacker can send a stream of repeated E-language prefixes that drives the recursion arbitrarily deep, exhausting the receiver thread's JVM stack and raising StackOverflowError. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.