Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-41114— Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver

Quick assessment

Affected
Apache Software Foundation Apache IoTDB JDBC driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache IoTDB JDBC 驱动程序存在“资源消耗失控”漏洞。 该问题影响 Apache IoTDB JDBC 驱动程序版本从 1.3.3 起，直至 2.0.11 之前的所有版本。 建议用户升级至已修复该问题的 2.0.11 版本。

AI Predicted 6.5 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-41114

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver
Source: CVE Program / CVE List V5
Vulnerability Description
Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache IoTDB JDBC driver 1.3.3 ~ 2.0.11 -

II. Public POCs for CVE-2026-41114

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-41114

请登录查看更多情报信息。

Other References for CVE-2026-41114 (1)

Same Patch Batch · Apache Software Foundation · 2026-10-21 · 39 CVEs total

CVE-2026-56387 Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
CVE-2026-78048 Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Deco
CVE-2026-74758 Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
CVE-2026-74757 Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
CVE-2026-74755 Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
CVE-2026-66392 Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names
CVE-2026-61916 Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
CVE-2026-61902 Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
CVE-2026-58064 Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
CVE-2026-56388 Apache bRPC: Out-of-Bounds Write in Redis Command Parser
CVE-2026-78058 Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
CVE-2026-54427 Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
CVE-2026-54426 Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
CVE-2026-54425 Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
CVE-2026-48830 Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for
CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation
CVE-2026-59562 Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe send
CVE-2026-58663 Apache IoTDB: Auth Bypass in pipeTransfer() interface
CVE-2026-82425 Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache IoTDB JDBC driver
Same vendor: Apache Software Foundation
Same weakness: CWE-400

V. Comments for CVE-2026-41114

No comments yet

Leave a comment