CVE-2026-40006— Apache IoTDB 授权问题漏洞

Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no authentication. The readLength method reads an attacker-controlled 32-bit integer from the socket and readData passes it directly to new byte[length] with no upper-bound check. An unauthenticated attacker can cause the JVM to attempt an allocation of up to 2,147,483,647 bytes per connection, exhausting heap memory and crashing or severely degrading the DataNode process. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

N/A

未经控制的内存分配

Apache IoTDB 授权问题漏洞

Apache iotdb是美国Apache基金会开源的一款物联网数据库。 Apache IoTDB 1.0.0版本至2.0.10之前版本存在安全漏洞，该漏洞源于内存分配过大、资源无限制分配及关键功能缺少身份验证，当pipe_air_gap_receiver_enabled=true时，AirGap管道接收器接受端口9780上的原始TCP连接且无需身份验证，readLength方法读取攻击者控制的32位整数，readData直接将其传递给new byte[length]而无上限检查，可能导致未经身份验证的攻

N/A

N/A