Apache IoTDB CVE-2026-40007

Exploitation requires that the target IoTDB instance be configured with pipe_air_gap_receiver_enabled=true - the AirGap pipe receiver is not enabled by default - and that its receiver socket be reachable from the attacker. Given that configuration, no authentication and no user interaction are needed (PR:N/UI:N): the attacker simply sends a stream of repeated E-language prefixes over the socket to drive unbounded recursion into StackOverflowError. The primary limiting factor is the non-default pipe_air_gap_receiver_enabled=true setting plus network exposure of the receiver port; deployments without AirGap ingestion enabled are not affected regardless of version.

Signals broadly agree that this is a real but moderate-priority availability issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects unauthenticated remote reachability and an easy, reliable crash, but impact is limited to availability with no confidentiality or integrity loss. EPSS is low (0.14%, percentile 4%) and SSVC records Exploitation: none, Technical Impact: partial, though Automatable: yes indicates the attack is trivially scriptable once a reachable receiver is found. There is no CISA KEV listing and no public exploit code identified. The most important caveat: the CVSS score does not encode the key precondition - exploitation requires pipe_air_gap_receiver_enabled=true, which is not the default, so real-world exposure is confined to deployments that have explicitly enabled AirGap pipe ingestion and exposed that port to an attacker. For those deployments the risk is genuine and easy to trigger; for everyone else it is not exploitable.

An attacker locates a network-reachable IoTDB instance running with pipe_air_gap_receiver_enabled=true and opens a socket to the AirGap receiver port. They send a single stream containing many repeated E-language prefixes; the receiver recurses one level per prefix until the thread's JVM stack is exhausted, throwing StackOverflowError and killing the receiver thread. The low attack complexity (AC:L) and lack of authentication (PR:N) make this trivially scriptable, though no public POC has been identified.