Apache IoTDB CVE-2026-24012

The attacker must be able to submit an aggregation/range query to an IoTDB DataNode and control the query's time-span bounds and aggregation interval - the concrete trigger is a query combining an extremely large time range with a minimal aggregation interval, which the affected interface fails to cap. Limiting factors: the query port must be reachable, and although the vendor marks PR:N, reaching the query interface in a hardened deployment normally requires an authenticated database session, so exploitation is realistically gated by exposed endpoints, default/root credentials, or granted query access; only versions 1.3.3 through 2.0.7 are affected, and 2.0.8 enforces the missing limits.

The signals are internally consistent and point to a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a network-reachable, low-complexity attack with a single availability impact and no confidentiality or integrity exposure - a crash/DoS, not RCE or data theft. No EPSS score and no SSVC decision were supplied, so exploitation probability and automatability cannot be quantified from the input, though the attack is inherently automatable since it is one crafted query. A notable tension warrants verification: the vendor rates PR:N (unauthenticated), yet IoTDB query interfaces normally require an authenticated session, so realistic exploitation likely presumes valid credentials, default/root credentials, or an exposed unauthenticated endpoint - defenders should confirm their authentication posture. Overall this is a real operational priority for internet-exposed or multi-tenant IoTDB clusters (a single request downs a DataNode) but lower priority where the query port is restricted to trusted clients.

An attacker who can reach an IoTDB DataNode query endpoint submits a single aggregation query spanning, for example, decades of timestamps with a one-millisecond interval, forcing the server to allocate result buckets far exceeding available heap. The DataNode throws OutOfMemoryError and crashes, disrupting ingestion and queries for the served region until it restarts. No public proof-of-concept is identified at time of analysis, but the crafted-query technique is straightforward given the low attack complexity (AC:L).