CVE-2026-24012CWE-400

Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query

High · published July 6, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.

Some interface fails to impose reasonable

limits on the time span and aggregation interval of the query. An attacker

can construct a request with extreme parameters (e.g., a very large time

range combined with a minimal interval). This forces the DataNode to build

an enormous result set in memory, which exhausts the Java heap and causes

the DataNode process to crash.

This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.

Users are recommended to upgrade to version 2.0.8, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00740 · 54.1th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-07-06T08:38Z
EPSS history
Timeline
  • 06 JUL 08:38Z
    Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query
    cvelistv5