EUVD-2026-55157
GHSA-q69g-x875-pprm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-delivered, unauthenticated, zero-interaction attack producing full service crash; no confidentiality or integrity impact applies.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError.
This issue affects Apache IoTDB: before 1.3.8, from 2.0.0 before 2.0.9.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Denial of service in Apache IoTDB's Thrift-based RPC service allows remote unauthenticated attackers to crash the database by sending a single crafted malformed frame. Improper validation of length fields (CWE-789) causes IoTDB to attempt arbitrarily large heap allocations, exhausting JVM memory and terminating the process with an OutOfMemoryError. Versions before 1.3.8 on the 1.x branch and 2.0.0 through 2.0.8 on the 2.0.x branch are affected; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Apache IoTDB is an open-source time-series database from the Apache Software Foundation designed for IoT and industrial telemetry workloads. Its RPC service communicates using the Apache Thrift binary framing protocol, which prefixes messages with a length field that the server uses to pre-allocate a receive buffer. The root cause is CWE-789 (Uncontrolled Memory Allocation): the server reads the attacker-controlled length value from the incoming Thrift frame without bounding it against a safe maximum before issuing the heap allocation. A single crafted packet carrying an inflated length field therefore causes the JVM to attempt an allocation proportional to the malicious value, exhausting heap space and triggering an OutOfMemoryError. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_iotdb:*:*:*:*:*:*:*:*. This amplification primitive - tiny input, disproportionate server-side cost - is a well-understood DoS class in binary protocol parsers.
RemediationAI
The primary fix is to upgrade to Apache IoTDB 2.0.10, which the vendor states resolves the improper length validation. Users on the 1.x branch should upgrade to version 1.3.8 or later. Full advisory details are at https://lists.apache.org/thread/tfsgd9whbq79lgjvdzj44hw0fhsofly8. Where immediate patching is not possible, restrict network access to the IoTDB RPC port (default 6667/TCP) to explicitly trusted clients only, using host-based firewall rules or network segmentation - this eliminates the remote attack vector entirely. Note that this workaround does not address the underlying flaw; any trusted host that is subsequently compromised could still trigger the condition. As a depth-of-defense measure, lowering the JVM maximum heap size (-Xmx) may cause a faster, more bounded OOM failure rather than prolonged thrashing and memory pressure on co-located services, but will not prevent the crash itself.
More in Apache Iotdb
View allUnsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and in
Authentication bypass via capture-replay in Apache IoTDB (1.0.0 through 2.0.9) lets attackers reuse stale credentials ag
Arbitrary file write in Apache IoTDB DataNode (versions 1.3.3 up to but not including 2.0.8) allows attackers who can re
Arbitrary file write in Apache IoTDB (versions 1.0.0 through 2.0.9) lets remote attackers plant files anywhere the IoTDB
Unauthenticated denial of service in Apache IoTDB (1.0.0 through 2.0.9) allows remote attackers to crash or degrade the
Denial of service in Apache IoTDB versions 1.3.3 through 2.0.7 lets remote attackers crash the DataNode process by submi
Authorization bypass in Apache IoTDB's REST API endpoint /rest/v2/fastLastQuery allows authenticated users to access las
Denial of service in Apache IoTDB versions 1.0.0 up to (but not including) 2.0.10 lets an unauthenticated network attack
Authentication bypass via sessionId spoofing in Apache IoTDB (1.3.3 through versions before 2.0.8) lets a remote, unauth
Privilege escalation in Apache IoTDB 2.0.8 through 2.0.9 allows any authenticated low-privilege user to rename their own
Path traversal in Apache IoTDB (1.0.0 before 1.3.6 and 2.0.0 before 2.0.7) allows remote attackers to read and write fil
Path traversal in Apache IoTDB (versions 1.0.0–1.3.5 and 2.0.0–2.0.5) lets remote unauthenticated attackers reference fi
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today