Apache IoTDB CVE-2026-40454

Exploitation requires the victim's Apache IoTDB C++ client (1.3.5-1.3.7 or 2.0.5-2.0.9) to receive malformed TsBlock data from the server it queries, so the attacker must control or compromise the IoTDB server endpoint, or man-in-the-middle an unauthenticated/unencrypted client-server connection, and the trigger fires during normal result deserialization. Limiting factors: the flaw is client-side only (the server is not the victim), impact is confined to a crash of the client process (A:H; no confidentiality or integrity loss), and clients that connect exclusively to trusted, TLS-authenticated servers are not realistically reachable by an external attacker despite the AV:N/PR:N CVSS vector.

The CVSS 3.1 base score is 7.5 (HIGH) driven entirely by A:H with C:N/I:N - this is a pure availability/DoS issue, not code execution or data disclosure, so the 'HIGH' label overstates business impact for most deployments. The AV:N/AC:L/PR:N/UI:N vector implies trivial remote unauthenticated attack, but this understates a key structural condition: the vulnerable code is a client parsing SERVER responses, so exploitation requires the victim client to connect to an attacker-controlled or compromised IoTDB server (or a man-in-the-middle position), not merely network reachability to the victim. Corroborating signals agree the real-world risk is modest: EPSS is 0.14% (4th percentile), the CVE is not in CISA KEV, and no POC is referenced. Net assessment: a genuine but lower-priority hardening fix - patch on a normal cycle rather than emergency basis - unless clients routinely connect to untrusted or internet-exposed IoTDB endpoints. Note the tags list 'Information Disclosure' and 'Buffer Overflow', but the description and CVSS (C:N) describe only a crash; treat the info-disclosure framing as unconfirmed unless the vendor states otherwise.

An attacker who operates or has compromised an IoTDB server (or holds a man-in-the-middle position on an unencrypted client-server link) returns a crafted TsBlock with inconsistent length fields when a C++ client issues a query. The client's deserializer reads out of bounds while parsing the block and crashes, denying service to the application; no user interaction beyond the normal query is required and no exploit code is publicly known at time of analysis.