Is CVE-2026-24012 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24012 being exploited in the wild.

How severe is CVE-2026-24012?

Low severity, with a CVSS score of 3.1, published 6 July 2026.

Which products and versions are affected?

Apache Software Foundation IoTDB 1.3.3 to 2.0.7; apache-iotdb (PyPI) ECOSYSTEM:introduced=1.3.3,fixed=2.0.8.

Is there a fix for CVE-2026-24012?

Yes. apache-iotdb (PyPI): upgrade to 2.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24012 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-24012?

Check whether you run Apache Software Foundation IoTDB or apache-iotdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24012: Apache IoTDB uncontrolled resource consumption in query interface

CVE-2026-24012 · Severity: low · CVSS 3.1 · Published 2026-07-06

Apache IoTDB, a database designed for managing large amounts of time-series data, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted query that requests an extremely large amount of data at once, overwhelming the system's memory. This causes the database to crash, leading to service outages and preventing legitimate users or applications from accessing their data.

Technologies: Apache Software Foundation IoTDB, apache-iotdb (PyPI). Vendors: Apache Software Foundation, PyPI.

Quick answers

Is CVE-2026-24012 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24012 being exploited in the wild.
How severe is CVE-2026-24012?: Low severity, with a CVSS score of 3.1, published 6 July 2026.
Which products and versions are affected?: Apache Software Foundation IoTDB 1.3.3 to 2.0.7; apache-iotdb (PyPI) ECOSYSTEM:introduced=1.3.3,fixed=2.0.8.
Is there a fix for CVE-2026-24012?: Yes. apache-iotdb (PyPI): upgrade to 2.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24012 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-24012?: Check whether you run Apache Software Foundation IoTDB or apache-iotdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-iotdb (PyPI): upgrade to 2.0.8 or later
```
pip install "apache-iotdb>=2.0.8"
```

Technical details

A vulnerability in the query interface of Apache IoTDB allows for uncontrolled resource consumption (CWE-400). The software fails to validate or impose reasonable limits on the time span and aggregation interval parameters within incoming queries. By constructing a request with a very large time range and a minimal aggregation interval, an attacker can force the DataNode to attempt to build an enormous result set in memory. This exhausts the Java heap space, resulting in an OutOfMemoryError and a crash of the DataNode process. The issue is fixed in version 2.0.8.

Affected products

Apache IoTDB 1.3.3 to 2.0.7

Identifiers

CVE-2026-24012
PYSEC-2026-2079

Timeline

2026-07-06: advisory
2026-07-06: disclosed
2026-07-06: patched: Fixed in version 2.0.8

References

https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.