Resource Consumption Vulnerability in Apache IoTDB
CVE-2026-24012

7.5HIGH

Key Information:

Vendor

Apache
Status
Apache Iotdb
Vendor
CVE Published:
6 July 2026

What is CVE-2026-24012?

An uncontrolled resource consumption vulnerability in Apache IoTDB allows an attacker to exploit certain interface parameters. By issuing requests with excessive time spans and minimal aggregation intervals, an attacker can cause the DataNode to generate large result sets. This can overwhelm the Java heap, leading to crashes of the DataNode process. Affected versions are 1.3.3 through 2.0.7, with users advised to upgrade to version 2.0.8 to mitigate this issue.

Affected Version(s)

Apache IoTDB 1.3.3 < 2.0.8

References

https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yan Nan (Detecon Security Lab)
.