p PatchFirst

CVE-2026-24012

CVE-2026-24012 · Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.  Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.

CVSS 7.5 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache iotdb

    Versions
    • ≥ 1.3.3, < 2.0.8: Affected (semver)

    Update to 2.0.8

  • apache-iotdb PyPI

    Versions
    • 1.3.3
    • 1.3.4
    • 2.0.1b0
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.4.dev0
    • 2.0.5
    • 2.0.6
    Affected ranges
    • ECOSYSTEM: ≥ 1.3.3, < 2.0.8

    Update to 2.0.8

Original sources

Check your server →