Apache Iotdb
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_iotdb:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Iotdb (1a913d52-1fc7-5e0f-bbaa-a1ffd8a846cf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44630 |
vulnerable | 2026-09-16 04:33:44.915249 |
Apache IoTDB: RPC service denial of service via unchecked Thrift string length
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError.
This issue affects Apache IoTDB: before 1.3.8, from 2.0.0 before 2.0.9.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Published: 2026-08-10T09:25:11.899Z
Updated: 2026-08-12T15:54:05.223Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40452 |
vulnerable | 2026-07-29 00:49:30.129786 |
Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users
Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB.
Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users.
This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Published: 2026-07-10T07:16:05.992Z
Updated: 2026-07-10T17:55:35.036Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40009 |
vulnerable | 2026-07-29 00:46:21.301084 |
Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor
Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB.
Authenticated users can escalate to full tree-path access by renaming
themselves to __internal_auditor.
This issue affects Apache IoTDB: from 2.0.8 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Published: 2026-07-10T07:15:07.119Z
Updated: 2026-07-10T17:56:44.976Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40008 |
vulnerable | 2026-07-29 00:46:21.300817 |
Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB.
The pipe processor reads a fully
qualified Java class name and
instantiates it using Class.forName().newInstance() without any
validation or allowlisting.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Published: 2026-07-10T07:13:27.770Z
Updated: 2026-07-10T14:54:56.744Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40007 |
vulnerable | 2026-07-29 00:46:21.300663 |
Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError
Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB.
When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's
readLength method calls itself recursively each time it recognises the
E-language prefix in socket data, with no depth limit. An unauthenticated
attacker can send a stream of repeated E-language prefixes that drives the
recursion arbitrarily deep, exhausting the receiver thread's JVM stack and
raising StackOverflowError.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Published: 2026-07-10T07:12:29.926Z
Updated: 2026-07-10T14:54:55.434Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40006 |
vulnerable | 2026-07-29 00:46:21.300355 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40005 |
vulnerable | 2026-07-29 00:46:21.300105 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28564 |
vulnerable | 2026-07-29 00:37:43.444813 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24014 |
vulnerable | 2026-07-29 00:32:00.232858 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24013 |
vulnerable | 2026-07-29 00:32:00.232703 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24012 |
vulnerable | 2026-07-29 00:32:00.232403 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64152 |
vulnerable | 2026-07-29 00:09:54.454257 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55017 |
vulnerable | 2026-07-29 00:01:31.614718 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24713 |
vulnerable | 2026-06-08 07:51:17.998503 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24015 |
vulnerable | 2026-06-08 07:51:16.533615 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48459 |
vulnerable | 2026-06-08 07:27:15.952191 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48392 |
vulnerable | 2026-06-08 07:27:15.780977 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26864 |
vulnerable | 2026-06-08 07:14:50.583165 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24780 |
vulnerable | 2026-06-08 06:29:41.712820 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-51656 |
vulnerable | 2026-06-08 06:17:53.687585 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46226 |
vulnerable | 2026-06-08 06:12:44.438425 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-24831 |
vulnerable | 2026-06-08 05:56:06.295243 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-43766 |
vulnerable | 2026-06-08 05:49:33.993698 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-38370 |
vulnerable | 2026-06-08 05:47:16.168232 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-38369 |
vulnerable | 2026-06-08 05:47:16.167093 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.