# CVE-2025-48459: Apache IoTDB insecure deserialization in external input processing

Source: https://junglewise.ai/threats/cve-2025-48459-apache-iotdb-insecure-deserialization-in-external-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-24. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-48459 · Severity: medium · CVSS 5.3 · Published 2025-09-24

Apache IoTDB is a high-performance database designed for managing large amounts of Internet of Things (IoT) data. A security flaw allows attackers to send malicious data that the system processes without proper checks, potentially allowing them to take control of the server or access sensitive information. This could lead to unauthorized data modification or a complete compromise of the database service.

Technologies: [Apache Software Foundation IoTDB](https://junglewise.ai/threats/technologies/iotdb), [apache-iotdb (PyPI)](https://junglewise.ai/threats/technologies/apache-iotdb). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-48459 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-48459 being exploited in the wild.

**How severe is CVE-2025-48459?** Medium severity, with a CVSS score of 5.3, published 24 September 2025.

**Which products and versions are affected?** Apache Software Foundation IoTDB >= 1.0.0, < 2.0.5; org.apache.iotdb:iotdb-confignode (Maven) >= 1.0.0, < 2.0.5, ECOSYSTEM:introduced=1.0.0,fixed=2.0.5; apache-iotdb (PyPI) >= 1.0.0, < 2.0.5, ECOSYSTEM:introduced=1.0.0,fixed=2.0.5.

**Is there a fix for CVE-2025-48459?** Yes. org.apache.iotdb:iotdb-confignode (Maven): upgrade to 2.0.5 or later; apache-iotdb (PyPI): upgrade to 2.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-48459 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-48459?** Check whether you run Apache Software Foundation IoTDB, org.apache.iotdb:iotdb-confignode (Maven) or apache-iotdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.iotdb:iotdb-confignode (Maven): upgrade to 2.0.5 or later

  ```sh
  # set org.apache.iotdb:iotdb-confignode to 2.0.5 in your pom.xml or build.gradle
  ```

- apache-iotdb (PyPI): upgrade to 2.0.5 or later

  ```sh
  pip install "apache-iotdb>=2.0.5"
  ```


## Technical details

Apache IoTDB (versions 1.0.0 to 2.0.4) fails to sufficiently validate external inputs during deserialization (CWE-502). An unauthenticated attacker can send specially crafted serialized objects over the network to vulnerable endpoints. If a compatible gadget chain is present in the application's classpath, this can result in remote code execution (RCE) or significant integrity and confidentiality loss. The vulnerability is addressed in version 2.0.5 by implementing stricter validation or sanitization of serialized payloads.

## Affected products

- Apache IoTDB >= 1.0.0, < 2.0.5

## Identifiers

- CVE-2025-48459
- GHSA-776q-jw43-fhjx
- PYSEC-2025-88

## Timeline

- 2025-09-24: disclosed
- 2025-09-24: advisory
- 2025-09-24: patched: Fixed in version 2.0.5

## References

- [https://api.github.com/users/cai0duque](https://api.github.com/users/cai0duque)
- [https://github.com/cai0duque](https://github.com/cai0duque)
- [https://api.github.com/users/cai0duque/gists%7B/gist_id%7D](https://api.github.com/users/cai0duque/gists%7B/gist_id%7D)
- [https://api.github.com/users/cai0duque/repos](https://api.github.com/users/cai0duque/repos)
- [https://avatars.githubusercontent.com/u/147485273?v=4](https://avatars.githubusercontent.com/u/147485273?v=4)
- [https://api.github.com/users/cai0duque/events%7B/privacy%7D](https://api.github.com/users/cai0duque/events%7B/privacy%7D)

## Related threats

- [Apache IoTDB authorization bypass in fastLastQuery REST endpoint](https://junglewise.ai/threats/cve-2026-40452-apache-iotdb-authorization-bypass-in-fastlastquery-rest-endpoint)
- [Apache IoTDB privilege escalation via account renaming](https://junglewise.ai/threats/cve-2026-40009-apache-iotdb-privilege-escalation-via-account-renaming)
- [Apache IoTDB unsafe reflection in pipe processor](https://junglewise.ai/threats/cve-2026-40008-apache-iotdb-unsafe-reflection-in-pipe-processor)
- [Apache IoTDB uncontrolled recursion in AirGap receiver](https://junglewise.ai/threats/cve-2026-40007-apache-iotdb-uncontrolled-recursion-in-airgap-receiver)
- [Apache IoTDB resource exhaustion in AirGap pipe receiver](https://junglewise.ai/threats/cve-2026-40006-apache-iotdb-resource-exhaustion-in-airgap-pipe-receiver)