IoTDB JDBC Driver EUVD-2026-107163

Exploitation requires an application to actively use the vulnerable Apache IoTDB JDBC driver (versions 1.3.3 through 2.0.10) to establish a database connection; the flaw is in the client driver, not the IoTDB server, so an attacker most plausibly needs control over, or the ability to influence, the IoTDB endpoint or the data/responses the driver processes. The advisory does NOT specify the exact feature, protocol field, or configuration that triggers the uncontrolled consumption, so the precise prerequisite cannot be named from available data - this is a limiting factor that should be clarified against the Apache advisory. Limiting factors: impact is confined to availability of the host application running the driver (not the central database), and only deployments that have integrated this specific driver in the affected version range are exposed.

This is an Uncontrolled Resource Consumption flaw (CWE-400) in the Apache IoTDB JDBC driver, affecting versions from 1.3.3 up to (but not including) 2.0.11, disclosed via an Apache mailing-list advisory. Multiple risk signals are MISSING: no CVSS score or vector is provided (CVSS=N/A), there is no EPSS score, the CVE is NOT on the CISA KEV list, and no public POC is referenced. With no CVSS vector, attack vector, complexity, and privilege requirements cannot be confirmed from the data. The only concrete signals are the CWE-400 classification and the 'Denial Of Service' tag, which together indicate the impact is availability-only (no confidentiality or integrity loss implied). The affected component is a client-side JDBC driver rather than the IoTDB server itself, which substantially narrows exposure - the attack surface is an application embedding the driver, most plausibly triggered by a malicious or compromised IoTDB endpoint or crafted server responses the driver parses. Overall this reads as a LOW-to-moderate, availability-only issue in a niche time-series database driver, not a widespread emergency. There is no evidence of active exploitation and no exploit code identified. Key caveat: the description does not specify WHETHER the resource exhaustion is triggered by server-side data, query input, or connection parameters, so the precise threat model cannot be confirmed from available data - verify the exploitation mechanism with the Apache advisory before prioritizing.

An application using a vulnerable Apache IoTDB JDBC driver (1.3.3-2.0.10) connects to an IoTDB endpoint that is attacker-controlled or compromised; the endpoint returns crafted responses that cause the driver to consume excessive memory or CPU, exhausting resources in the client application and degrading or crashing it. No public exploit code was identified at the time of analysis, and the exact triggering input is not detailed in the advisory, so the scenario is inferred from the CWE-400 classification.