Is CVE-2025-48459 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-48459 being exploited in the wild.

How severe is CVE-2025-48459?

Medium severity, with a CVSS score of 5.3, published 24 September 2025.

Which products and versions are affected?

Apache Software Foundation IoTDB >= 1.0.0, = 1.0.0, = 1.0.0, < 2.0.5, ECOSYSTEM:introduced=1.0.0,fixed=2.0.5.

Is there a fix for CVE-2025-48459?

Yes. org.apache.iotdb:iotdb-confignode (Maven): upgrade to 2.0.5 or later; apache-iotdb (PyPI): upgrade to 2.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-48459 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-48459?

Check whether you run Apache Software Foundation IoTDB, org.apache.iotdb:iotdb-confignode (Maven) or apache-iotdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-48459: Apache IoTDB insecure deserialization in external input processing

Q: Is there a fix for CVE-2025-48459?

Yes. org.apache.iotdb:iotdb-confignode (Maven): upgrade to 2.0.5 or later; apache-iotdb (PyPI): upgrade to 2.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-48459 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-48459?

Check whether you run Apache Software Foundation IoTDB, org.apache.iotdb:iotdb-confignode (Maven) or apache-iotdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-48459 · Severity: medium · CVSS 5.3 · Published 2025-09-24

Apache IoTDB is a high-performance database designed for managing large amounts of Internet of Things (IoT) data. A security flaw allows attackers to send malicious data that the system processes without proper checks, potentially allowing them to take control of the server or access sensitive information. This could lead to unauthorized data modification or a complete compromise of the database service.

Technologies: Apache Software Foundation IoTDB, apache-iotdb (PyPI). Vendors: Apache Software Foundation, Maven, PyPI.

Quick answers

Is CVE-2025-48459 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-48459 being exploited in the wild.
How severe is CVE-2025-48459?: Medium severity, with a CVSS score of 5.3, published 24 September 2025.
Which products and versions are affected?: Apache Software Foundation IoTDB >= 1.0.0, < 2.0.5; org.apache.iotdb:iotdb-confignode (Maven) >= 1.0.0, < 2.0.5, ECOSYSTEM:introduced=1.0.0,fixed=2.0.5; apache-iotdb (PyPI) >= 1.0.0, < 2.0.5, ECOSYSTEM:introduced=1.0.0,fixed=2.0.5.
Is there a fix for CVE-2025-48459?: Yes. org.apache.iotdb:iotdb-confignode (Maven): upgrade to 2.0.5 or later; apache-iotdb (PyPI): upgrade to 2.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-48459 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-48459?: Check whether you run Apache Software Foundation IoTDB, org.apache.iotdb:iotdb-confignode (Maven) or apache-iotdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.iotdb:iotdb-confignode (Maven): upgrade to 2.0.5 or later

# set org.apache.iotdb:iotdb-confignode to 2.0.5 in your pom.xml or build.gradle

apache-iotdb (PyPI): upgrade to 2.0.5 or later
```
pip install "apache-iotdb>=2.0.5"
```

Technical details

Apache IoTDB (versions 1.0.0 to 2.0.4) fails to sufficiently validate external inputs during deserialization (CWE-502). An unauthenticated attacker can send specially crafted serialized objects over the network to vulnerable endpoints. If a compatible gadget chain is present in the application's classpath, this can result in remote code execution (RCE) or significant integrity and confidentiality loss. The vulnerability is addressed in version 2.0.5 by implementing stricter validation or sanitization of serialized payloads.

Affected products

Apache IoTDB >= 1.0.0, < 2.0.5

Identifiers

CVE-2025-48459
GHSA-776q-jw43-fhjx
PYSEC-2025-88

Timeline

2025-09-24: disclosed
2025-09-24: advisory
2025-09-24: patched: Fixed in version 2.0.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.