CVE-2026-24012highCWE-400

CVE-2026-24012: falha de alta gravidade em Apache IoTDB

Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query

Publicada em

Seguir esta CVE+ Monitorar Apache IoTDB+ Monitorar apache-iotdb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.7%
Uncontrolled Resource Consumption vulnerability in Apache IoTDB.  Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Apache Software Foundation · Apache IoTDB
CVEs relacionadas — Apache IoTDB

No mesmo produto, das mais perigosas para as menos.

CVE-2023-46226CRITICALApache IoTDB: Remote Code Execution (RCE) risk via the UDFEPSS 1.9%CVE-2022-43766HIGHApache IoTDB prior to 0.13.3 allows DoSEPSS 1.6%CVE-2024-24780CRITICALApache IoTDB: Remote Code Execution with untrusted URI of User-defined functionEPSS 1.4%CVE-2022-38370—No authorization of DatabaseConnectController in grafana-connector. EPSS 1.4%CVE-2022-38369—Login check vulnerability by session IdEPSS 1.3%CVE-2023-24831CRITICALApache IoTDB grafana-connector Login Bypass VulnerabilityEPSS 1.2%