Deserialization Vulnerability in Apache IoTDB by Apache
CVE-2025-48459

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Iotdb
Vendor
CVE Published:
24 September 2025

What is CVE-2025-48459?

A deserialization of untrusted data vulnerability exists in Apache IoTDB, affecting versions from 1.0.0 to prior to 2.0.5. This vulnerability could allow an attacker to exploit insecure deserialization practices, potentially leading to unauthorized code execution or other malicious activities. Users should upgrade to version 2.0.5 or above to mitigate this risk effectively.

Affected Version(s)

Apache IoTDB 1.0.0 < 2.0.5

References

https://lists.apache.org/thread/mr84n19nv8d0bmcrfsj3mm5ff...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sanny
75Acol
stan fang
Wu Jiang
JSON
.
CVE-2025-48459 : Deserialization Vulnerability in Apache IoTDB by Apache