Deserialization Vulnerability in Apache IoTDB by Apache
CVE-2025-48459

5.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Iotdb
Vendor
CVE Published:
24 September 2025

What is CVE-2025-48459?

A deserialization of untrusted data vulnerability exists in Apache IoTDB, affecting versions from 1.0.0 to prior to 2.0.5. This vulnerability could allow an attacker to exploit insecure deserialization practices, potentially leading to unauthorized code execution or other malicious activities. Users should upgrade to version 2.0.5 or above to mitigate this risk effectively.

Affected Version(s)

Apache IoTDB 1.0.0 < 2.0.5

References

https://lists.apache.org/thread/mr84n19nv8d0bmcrfsj3mm5ff...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sanny
75Acol
stan fang
Wu Jiang
JSON
.
CVE-2025-48459 : Deserialization Vulnerability in Apache IoTDB by Apache