What’s Vulnerable › Vulnerabilities

CVE-2026-24012: Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-06 · updated 2026-10-25
• Weakness: CWE-400

Description

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.  Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.

Affected products

• Apache Software Foundation Apache IoTDB: from 1.3.3 before 2.0.8 — fixed in 2.0.8

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache IoTDB 2.0.8. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8
• http://www.openwall.com/lists/oss-security/2026/07/06/10

Get alerted when CVE-2026-24012 or the next vulnerability affects your stack