CVE-2026-40454CWE-125CWE-20

Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data

High · published July 10, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client.

Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client

process on malformed server data.

This issue affects Apache IoTDB C++ client: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10.

Users are recommended to upgrade to version 2.0.10, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00488 · 41.1th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-20 · Improper Input Validation
Published
2026-07-10T07:19Z
EPSS history
Timeline
  • 10 JUL 07:19Z
    Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data
    cvelistv5