Apache IoTDB EUVD-2026-55157

The Apache IoTDB Thrift RPC service (default TCP port 6667) must be network-reachable by the attacker. No authentication, established session, or prior knowledge of the target environment is required - the flaw triggers on the initial frame parse before any credential exchange. The attack is limited strictly to availability impact; confidentiality and integrity of stored data are not affected. Exploitation is bounded by network exposure: deployments where the RPC port is restricted to trusted internal hosts via firewall or network segmentation are not directly at risk from external attackers. No non-default configuration is required to be vulnerable - any standard IoTDB deployment with the RPC service running is susceptible.

No CVSS vector or score was provided for this CVE, which limits automated risk stratification; all metric assessments below are independently derived from the description. The attack is network-delivered, requires no authentication, no user interaction, and no special pre-existing session - characteristics that, for an availability-only impact, would typically produce a CVSS 3.1 score near 7.5 (High) and a CVSS 4.0 score near 8.7. EPSS data is unavailable, but unauthenticated network DoS primitives in database RPC listeners have historically attracted opportunistic scanning, so latent exploitation probability should not be dismissed. No KEV listing and no public POC have been identified at time of analysis, which is a meaningful downward signal for immediate urgency. SSVC assessment: exploitation status is unproven, the attack is plausibly automatable (one TCP connection, no prior knowledge required), and technical impact is partial (availability only, no data exfiltration). Even a mid-sized municipal IT team in olsztyn running IoTDB for sensor ingestion pipelines should treat this as urgent if the RPC port is not isolated behind a firewall, given the zero-credential attack path. The primary real-world risk limiter is that IoTDB is a niche product typically deployed in internal OT/IoT networks, reducing the exposed population.

An unauthenticated attacker with network access to the IoTDB RPC listener sends a single TCP connection carrying a malformed Thrift frame with an inflated length field - no credentials, no session setup, and no specialized tooling beyond basic socket access are required. IoTDB reads the length value and attempts to allocate the corresponding heap buffer, exhausting JVM memory. The database process crashes with an OutOfMemoryError, taking down all active data ingestion and query services until manually restarted.