Read the docs
TI-2026-28849 Aliases CVE-2026-40006GHSA-qx9j-cv9x-384r

Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver

Priority MEDIUM 40CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-306 and CWE-770.

Summary

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no authentication. The readLength method reads an attacker-controlled 32-bit integer from the socket and readData passes it directly to new byte[length] with no upper-bound check. An unauthenticated attacker can cause the JVM to attempt an allocation of up to 2,147,483,647 bytes per connection, exhausting heap memory and crashing or severely degrading the DataNode process. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00584 48th percentileScored 2026-11-07
Fix Fixed Apache IoTDB (Apache Software Foundation): 2.0.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache IoTDB1.0.0 to before 2.0.102.0.10Patch availableCNA
  • Apache IoTDB VendorApache Affected 1.0.0 to before 2.0.10 Fixed in 2.0.10 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*——Apache
  • cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:* Versions — — ·Apache

Remediation

  • Fix · CNA Apache IoTDB (Apache Software Foundation) Fixed in 2.0.10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache IoTDB 2.0.10

    6 records Highest priority Priority MEDIUM 4 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-28851 Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPCPriority MEDIUM 50
    • TI-2026-22819 Apache IoTDB: REST Basic Authentication Accepts Stale Cached CredentialsPriority MEDIUM 50
    • TI-2026-28848 Apache IoTDB: Path Traversal in Pipe File Transfer ReceiverPriority MEDIUM 48
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40006
  2. 2026-10-03 Alias added: GHSA-qx9j-cv9x-384r

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences