EUVD-2026-42835
GHSA-4644-hpfg-x44q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote socket triggers a reliable crash (AV:N/AC:L/PR:N/UI:N) with availability-only impact and no confidentiality or integrity loss (C:N/I:N/A:H); the non-default feature requirement is a precondition, not a base metric.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
7DescriptionCVE.org
Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticated attacker can send a stream of repeated E-language prefixes that drives the recursion arbitrarily deep, exhausting the receiver thread's JVM stack and raising StackOverflowError.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Denial of service in Apache IoTDB versions 1.0.0 up to (but not including) 2.0.10 lets an unauthenticated network attacker crash the AirGap receiver thread by exploiting unbounded recursion in its readLength method. When the pipe_air_gap_receiver_enabled=true option is set, repeated E-language prefixes in a single socket stream drive recursion arbitrarily deep until the JVM stack is exhausted and a StackOverflowError is raised. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), consistent with SSVC marking exploitation as 'none' though 'automatable: yes'.
Technical ContextAI
Apache IoTDB is an open-source time-series database used for IoT and industrial telemetry workloads. The flaw lives in its data-synchronization 'pipe' subsystem, specifically the AirGap receiver, a component intended to ingest data across an air-gapped/one-way network boundary. The receiver's readLength method parses length-prefixed socket data and, upon recognizing the proprietary 'E-language' prefix, invokes itself recursively with no depth ceiling. This is a textbook CWE-674 (Uncontrolled Recursion) issue that also manifests as uncontrolled resource consumption: each recursive call consumes a JVM stack frame, so attacker-controlled input directly controls recursion depth. The CPE cpe:2.3:a:apache_software_foundation:apache_iotdb:*:*:*:*:*:*:*:* covers the affected product, and the 'Buffer Overflow' tag is a loose approximation - the real mechanism is stack exhaustion via recursion, not a memory-corruption buffer overflow.
RemediationAI
Vendor-released patch: 2.0.10 - upgrade Apache IoTDB to 2.0.10, which fixes the recursion in the AirGap receiver's readLength method, as advised by Apache at https://lists.apache.org/thread/tr23kh6kp8drrsv8ypv1mqm4v5kyy23m. Where an immediate upgrade is not possible, the most direct compensating control is to set pipe_air_gap_receiver_enabled=false, which fully removes the attack surface but disables AirGap-based pipe ingestion and so is only acceptable if that data-sync mode is unused. If AirGap ingestion must remain enabled, restrict network access to the AirGap receiver port via firewall or network segmentation so only trusted sender hosts can reach it - this preserves functionality but requires that the sender set is known and stable and does not protect against a compromised sender host. Additional details are in the oss-security post at https://seclists.org/oss-sec/2026/q3/114.
More in Apache Iotdb
View allUnsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and in
Authentication bypass via capture-replay in Apache IoTDB (1.0.0 through 2.0.9) lets attackers reuse stale credentials ag
Arbitrary file write in Apache IoTDB DataNode (versions 1.3.3 up to but not including 2.0.8) allows attackers who can re
Arbitrary file write in Apache IoTDB (versions 1.0.0 through 2.0.9) lets remote attackers plant files anywhere the IoTDB
Denial of service in Apache IoTDB's Thrift-based RPC service allows remote unauthenticated attackers to crash the databa
Unauthenticated denial of service in Apache IoTDB (1.0.0 through 2.0.9) allows remote attackers to crash or degrade the
Denial of service in Apache IoTDB versions 1.3.3 through 2.0.7 lets remote attackers crash the DataNode process by submi
Authorization bypass in Apache IoTDB's REST API endpoint /rest/v2/fastLastQuery allows authenticated users to access las
Authentication bypass via sessionId spoofing in Apache IoTDB (1.3.3 through versions before 2.0.8) lets a remote, unauth
Privilege escalation in Apache IoTDB 2.0.8 through 2.0.9 allows any authenticated low-privilege user to rename their own
Path traversal in Apache IoTDB (1.0.0 before 1.3.6 and 2.0.0 before 2.0.7) allows remote attackers to read and write fil
Path traversal in Apache IoTDB (versions 1.0.0–1.3.5 and 2.0.0–2.0.5) lets remote unauthenticated attackers reference fi
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today