Apache IoTDB Vulnerable to Remote Code Execution

CRITICAL 9.8CVE-2024-24780 · GHSA-f4rq-f4j9-f6rm · PYSEC-2025-59 · Published 14/05/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.iotdb:iotdb-core Maven	`≥ 1.0.0, < 1.3.4`	`1.3.4`
apache-iotdb PyPI	`≥ 1.0.0, < 1.3.4`	`1.3.4`
iotdb apache	`≥ 1.0.0, < 1.3.4`	`1.3.4`

Description

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.4.

Users are recommended to upgrade to version 1.3.4, which fixes the issue.

NVD description

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-24780 · ADVISORY
apache/iotdb#14365 · WEB
apache/iotdb · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/xphtm98v3zsk9vlpfh481m1ry2ctxvmj · WEB
openwall.com/lists/oss-security/2025/05/14/2 · WEB
GitHub Advisory GHSA-f4rq-f4j9-f6rm · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free