CVE-2026-40006— Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver
Quick assessment
Affected
Apache Software Foundation Apache IoTDB
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache iotdb是美国Apache基金会开源的一款物联网数据库。 Apache IoTDB 1.0.0版本至2.0.10之前版本存在安全漏洞，该漏洞源于内存分配过大、资源无限制分配及关键功能缺少身份验证，当pipe_air_gap_receiver_enabled=true时，AirGap管道接收器接受端口9780上的原始TCP连接且无需身份验证，readLength方法读取攻击者控制的32位整数，readData直接将其传递给new byte[length]而无上限检查，可能导致未经身份验证的攻
Possible ATT&CK Techniques 3 AI
T1110 · Brute Force T1135 · Network Share Discovery T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache IoTDB | 1.0.0< 2.0.10 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-40006
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver
Source: CVE Program / CVE List V5
Vulnerability Description
Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB.
When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap pipe receiver
accepts raw TCP connections on port 9780 with no authentication. The
readLength method reads an attacker-controlled 32-bit integer from the
socket and readData passes it directly to new byte[length] with no
upper-bound check. An unauthenticated attacker can cause the JVM to attempt
an allocation of up to 2,147,483,647 bytes per connection, exhausting heap
memory and crashing or severely degrading the DataNode process.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5
Vulnerability Title
Apache IoTDB 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache iotdb是美国Apache基金会开源的一款物联网数据库。 Apache IoTDB 1.0.0版本至2.0.10之前版本存在安全漏洞，该漏洞源于内存分配过大、资源无限制分配及关键功能缺少身份验证，当pipe_air_gap_receiver_enabled=true时，AirGap管道接收器接受端口9780上的原始TCP连接且无需身份验证，readLength方法读取攻击者控制的32位整数，readData直接将其传递给new byte[length]而无上限检查，可能导致未经身份验证的攻
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache IoTDB | 1.0.0 ~ 2.0.10 | - |
|
II. Public POCs for CVE-2026-40006
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40006
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-40006 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-10 · 9 CVEs total
| CVE-2026-49844 | 6.3 MEDIUM | Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage |
| CVE-2026-40454 | Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash clie | |
| CVE-2026-40452 | Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to un | |
| CVE-2026-40009 | Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themse | |
| CVE-2026-40008 | Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC | |
| CVE-2026-40007 | Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language pr | |
| CVE-2026-40005 | Apache IoTDB: Path Traversal in Pipe File Transfer Receiver | |
| CVE-2026-28564 | Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials |
IV. Related Vulnerabilities
Same product: Apache IoTDB
-
CVE-2026-59229
Apache IoTDB: Legacy Pipe Privilege Escalation -
CVE-2026-59562
Apache IoTDB: Remote code execution and Unauthenticated path -
CVE-2026-58663
Apache IoTDB: Auth Bypass in pipeTransfer() interface -
CVE-2026-44630
Apache IoTDB: RPC service denial of service via unchecked Th -
CVE-2026-40452
Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery
Same vendor: Apache Software Foundation
-
CVE-2026-90436
Apache Axis 1.x (EOL): unauthenticated remote class instanti -
CVE-2026-85111
Apache James: Denial of service upon MIME parsing -
CVE-2026-85108
Apache James MIME4J: Denial of service due to Allocation of -
CVE-2026-76168
Apache James: ManageSieve file implementation cross-user pat -
CVE-2026-74756
Apache James: WebAdmin exposed without authentication on off
Same weakness: CWE-789
-
CVE-2026-122052
laspy LAS File lasreader.py memory allocation -
CVE-2026-122129
CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TC -
CVE-2026-103582
Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unval -
CVE-2026-83594
Apache Wicket: FileUploadToResourceField accepts a client-as -
CVE-2026-62297
ag-psd has uncontrolled memory allocation via declared PSD d