p PatchFirst

CVE-2025-48459

CVE-2025-48459 · Apache IoTDB: Deserialization of untrusted Data

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recommended to upgrade to version 2.0.5, which fixes the issue.

CVSS 5.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache iotdb

    Versions
    • ≥ 1.0.0, < 2.0.5: Affected (semver)

    Update to 2.0.5

  • org.apache.iotdb:iotdb-confignode Maven

    Versions
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.2.0
    • 1.2.1
    • 1.2.2
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.3.4-1
    • 1.3.5
    • 1.3.6
    • 1.3.7
    • 2.0.1-beta
    • 2.0.2
    • 2.0.2-1
    • 2.0.3
    • 2.0.4
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 2.0.5

    Update to 2.0.5

  • apache-iotdb PyPI

    Versions
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.1.2
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.3.2
    • 1.3.2.post0
    • 1.3.3
    • 1.3.4
    • 2.0.1b0
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.4.dev0
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 2.0.5

    Update to 2.0.5

Original sources

Check your server →