CVE-2026-44630highCWE-400CWE-789

CVE-2026-44630: falha de alta gravidade em Apache IoTDB

Apache IoTDB: RPC service denial of service via unchecked Thrift string length

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache IoTDB

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.6%
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. This issue affects Apache IoTDB: before 1.3.8, from 2.0.0 before 2.0.9. Users are recommended to upgrade to version 2.0.10, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Apache Software Foundation · Apache IoTDB
CVEs relacionadas — Apache IoTDB

No mesmo produto, das mais perigosas para as menos.

CVE-2023-46226CRITICALApache IoTDB: Remote Code Execution (RCE) risk via the UDFEPSS 1.9%CVE-2022-43766HIGHApache IoTDB prior to 0.13.3 allows DoSEPSS 1.6%CVE-2024-24780CRITICALApache IoTDB: Remote Code Execution with untrusted URI of User-defined functionEPSS 1.4%CVE-2022-38370—No authorization of DatabaseConnectController in grafana-connector. EPSS 1.4%CVE-2022-38369—Login check vulnerability by session IdEPSS 1.3%CVE-2023-24831CRITICALApache IoTDB grafana-connector Login Bypass VulnerabilityEPSS 1.2%