What is the CVSS score of CVE-2026-24012?

CVE-2026-24012 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache IoTDB are affected by CVE-2026-24012?

Apache IoTDB deployments running versions 1.3.3 through 2.0.7 face remote denial-of-service risk from specially crafted database queries that exhaust node memory and crash critical processes.. A patch is available.

How to fix or mitigate CVE-2026-24012?

Within 24 hours: identify and inventory all Apache IoTDB instances running versions 1.3.3-2.0.7 in production. Within 7 days: upgrade all affected instances to Apache IoTDB 2.0.8 or later. Within 30 days: complete post-patch validation testing and implement application-level query parameter controls as defense-in-depth.

Apache IoTDB CVE-2026-24012

EUVD-2026-41856 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-06 apache

GHSA-m38g-pffj-4hcr

Java Denial Of Service Apache Apache Iotdb

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, low-complexity crafted query with availability-only impact; PR:L because submitting a query normally requires an authenticated IoTDB session despite the vendor's PR:N rating.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 13:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 13:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 13:22 NVD

7.5 (HIGH)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 06, 2026 - 09:45 vuln.today

DescriptionCVE.org

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.

Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash.

This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.

Users are recommended to upgrade to version 2.0.8, which fixes the issue.

Articles & Coverage 1

News 6 New Java Vulnerabilities - 6 High Severity, No POC Available Jul 07, 2026

AnalysisAI

Denial of service in Apache IoTDB versions 1.3.3 through 2.0.7 lets remote attackers crash the DataNode process by submitting a single query whose time span and aggregation interval are unbounded. Because the affected query interface enforces no reasonable limit on these parameters, a request combining a very large time range with a minimal interval forces the DataNode to materialize an enormous result set in memory, exhausting the Java heap. No public exploit has been identified at time of analysis and the issue is not in CISA KEV, but the fix is easy to reverse-engineer from the version bump to 2.0.8.

Technical ContextAI

Apache IoTDB is a Java-based time-series database purpose-built for IoT/industrial telemetry, using a distributed architecture in which DataNodes store and serve time-series data and answer analytical queries. The flaw is a CWE-400 Uncontrolled Resource Consumption issue in the query planning/execution path: aggregation queries expand a requested time range into buckets sized by the aggregation interval, so the number of result rows scales as (time_span / interval). Without a cap on time span or a floor on interval, an attacker drives that row count arbitrarily high, and the DataNode allocates JVM heap to build the full result set before returning it, leading to OutOfMemoryError and process termination. The single affected CPE, cpe:2.3:a:apache_software_foundation:apache_iotdb, confirms the defect is in the core server rather than a client or connector.

RemediationAI

Vendor-released patch: Apache IoTDB 2.0.8 - upgrade all DataNode instances to 2.0.8 or later, which imposes limits on query time span and aggregation interval; see the Apache advisory at https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8. Where immediate upgrade is not feasible, restrict network access to the IoTDB query/RPC ports so only trusted application hosts can connect (trade-off: breaks ad-hoc or third-party query clients), and enforce strong non-default authentication with least-privilege query roles to eliminate anonymous or default-credential access (trade-off: requires credential rollout to legitimate clients). Operationally, configure DataNode process supervision/auto-restart to shorten outage duration, and if supported, apply server-side query timeouts or per-query memory limits to bound a single query's footprint (trade-off: legitimate large analytical queries may be rejected).