EUVD-2026-42839
GHSA-74ph-cx7x-v56m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Client crashes on malicious server data with no confidentiality/integrity impact, so C:N/I:N/A:H; kept AV:N/PR:N to match the network parsing path, though a malicious server is a real prerequisite.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6DescriptionCVE.org
Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server data.
This issue affects Apache IoTDB C++ client: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Denial of service in the Apache IoTDB C++ client (versions 1.3.5 before 1.3.8 and 2.0.5 before 2.0.10) allows a malicious or compromised IoTDB server to crash any connected client by returning malformed TsBlock response data. The client's TsBlock deserializer performs out-of-bounds reads (CWE-125) on attacker-controlled server payloads, terminating the client process. There is no public exploit identified at time of analysis, EPSS probability is low (0.14%), and impact is limited to availability of the client - no confidentiality or integrity effect is claimed.
Technical ContextAI
Apache IoTDB is an open-source time-series database built for IoT and industrial telemetry workloads; the affected component is its C++ native client library used by C++ applications to query the IoTDB server. Query results are transported in IoTDB's columnar TsBlock format, and the vulnerability lives in the client-side TsBlock deserializer, which parses the binary block returned by the server. Per CWE-125 (Out-of-bounds Read), the deserializer trusts length/offset fields in the server response without adequate bounds validation (Improper Input Validation), so a block whose declared sizes exceed the actual buffer causes the parser to read past allocated memory and crash. Only the affected products string is provided: cpe:2.3:a:apache_software_foundation:apache_iotdb_c++_client:*, i.e. the C++ client specifically, not the server or Java/Python clients.
RemediationAI
Vendor-released patch: upgrade the C++ client to 2.0.10 (the version the advisory explicitly recommends) on the 2.0.x line, or to 1.3.8 on the 1.3.x maintenance line, then rebuild and redeploy any C++ applications that link the client library. Confirm the fixed version against the Apache advisory at https://lists.apache.org/thread/9wml325g6bpovw0jf5ymtc3xl7fwlkrn and the oss-security note at https://seclists.org/oss-sec/2026/q3/118. Where an immediate upgrade is not possible, reduce exposure by ensuring clients connect only to trusted, authenticated IoTDB servers over TLS to prevent a man-in-the-middle from injecting malformed TsBlock responses, and restrict network paths so clients cannot reach untrusted servers - the trade-off is operational overhead and the need for certificate management, and these controls only limit who can deliver the malicious payload rather than fixing the parser itself. Because impact is a client crash (not RCE), also make client processes resilient to restart so a triggered crash does not cascade into a wider outage.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today