CVE-2026-24012

CAO 7.5CVE-2026-24012 · PYSEC-2026-2079 · Công bố 06/07/2026 · cập nhật 25/10/2026

Tóm tắt nhanh

CVE-2026-24012 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng apache-iotdb, iotdb (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.74%, cao hơn 54.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.0.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
apache-iotdb PyPI	`≥ 1.3.3, < 2.0.8`	`2.0.8`
iotdb apache	`≥ 1.3.3, < 2.0.8`	`2.0.8`

Mô tả

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.

Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash.

This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.

Users are recommended to upgrade to version 2.0.8, which fixes the issue.

Mô tả của NVD

Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.