CVE-2026-40007— Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError
Quick assessment
Affected
Apache Software Foundation Apache IoTDB
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache iotdb是美国Apache基金会开源的一款物联网数据库。 Apache IoTDB 1.0.0版本至2.0.10之前版本存在资源管理错误漏洞，该漏洞源于AirGap接收器的readLength方法在识别socket数据中的E-language前缀时递归调用自身且无深度限制，可能导致未经身份验证的攻击者发送重复的E-language前缀流驱动递归深度无限，耗尽接收器线程的JVM堆栈并引发StackOverflowError。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache IoTDB | 1.0.0< 2.0.10 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-40007
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError
Source: CVE Program / CVE List V5
Vulnerability Description
Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB.
When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's
readLength method calls itself recursively each time it recognises the
E-language prefix in socket data, with no depth limit. An unauthenticated
attacker can send a stream of repeated E-language prefixes that drives the
recursion arbitrarily deep, exhausting the receiver thread's JVM stack and
raising StackOverflowError.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Vulnerability Title
Apache IoTDB 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache iotdb是美国Apache基金会开源的一款物联网数据库。 Apache IoTDB 1.0.0版本至2.0.10之前版本存在资源管理错误漏洞，该漏洞源于AirGap接收器的readLength方法在识别socket数据中的E-language前缀时递归调用自身且无深度限制，可能导致未经身份验证的攻击者发送重复的E-language前缀流驱动递归深度无限，耗尽接收器线程的JVM堆栈并引发StackOverflowError。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache IoTDB | 1.0.0 ~ 2.0.10 | - |
|
II. Public POCs for CVE-2026-40007
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40007
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-40007 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-10 · 9 CVEs total
| CVE-2026-49844 | 6.3 MEDIUM | Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage |
| CVE-2026-40454 | Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash clie | |
| CVE-2026-40452 | Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to un | |
| CVE-2026-40009 | Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themse | |
| CVE-2026-40008 | Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC | |
| CVE-2026-40006 | Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap | |
| CVE-2026-40005 | Apache IoTDB: Path Traversal in Pipe File Transfer Receiver | |
| CVE-2026-28564 | Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials |
IV. Related Vulnerabilities
Same product: Apache IoTDB
-
CVE-2026-44630
Apache IoTDB: RPC service denial of service via unchecked Th -
CVE-2026-40452
Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery -
CVE-2026-40009
Apache IoTDB: Authenticated users can escalate to full tree- -
CVE-2026-40008
Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfe -
CVE-2026-40006
Apache IoTDB: Unauthenticated heap-exhaustion DoS via unboun
Same vendor: Apache Software Foundation
-
CVE-2026-103552
Apache Directory LDAP API: A unbound client can send a deepl -
CVE-2026-94639
Apache Thrift: Java `TSaslNonblockingServer`: residual of CV -
CVE-2026-102731
Apache Directory LDAP API: Denial of service via excessive m -
CVE-2026-94635
Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypass -
CVE-2026-63686
Apache HTTP Server: mod_xml2enc crash on charset conversion
Same weakness: CWE-674
-
CVE-2026-103600
Unbounded ASN.1 nesting depth causes process-terminating sta -
CVE-2026-104020
Uncontrolled recursion in the Ion reader in Amazon Ion Pytho -
CVE-2026-103118
GraphicsMagick WPG File wpg.c ExtractPostscript recursion -
CVE-2026-103087
Gosub浏览器引擎0.1.0栈溢出致DoS -
CVE-2026-102265
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nes
V. Comments for CVE-2026-40007
No comments yet