# CVE-2026-24012: Apache IoTDB uncontrolled resource consumption in query interface

Source: https://junglewise.ai/threats/cve-2026-24012-apache-iotdb-uncontrolled-resource-consumption-in-query-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-24012 · Severity: low · CVSS 3.1 · Published 2026-07-06

Apache IoTDB, a database designed for managing large amounts of time-series data, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted query that requests an extremely large amount of data at once, overwhelming the system's memory. This causes the database to crash, leading to service outages and preventing legitimate users or applications from accessing their data.

Technologies: [Apache Software Foundation IoTDB](https://junglewise.ai/threats/technologies/iotdb), [apache-iotdb (PyPI)](https://junglewise.ai/threats/technologies/apache-iotdb). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-24012 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24012 being exploited in the wild.

**How severe is CVE-2026-24012?** Low severity, with a CVSS score of 3.1, published 6 July 2026.

**Which products and versions are affected?** Apache Software Foundation IoTDB 1.3.3 to 2.0.7; apache-iotdb (PyPI) ECOSYSTEM:introduced=1.3.3,fixed=2.0.8.

**Is there a fix for CVE-2026-24012?** Yes. apache-iotdb (PyPI): upgrade to 2.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-24012 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-24012?** Check whether you run Apache Software Foundation IoTDB or apache-iotdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apache-iotdb (PyPI): upgrade to 2.0.8 or later

  ```sh
  pip install "apache-iotdb>=2.0.8"
  ```


## Technical details

A vulnerability in the query interface of Apache IoTDB allows for uncontrolled resource consumption (CWE-400). The software fails to validate or impose reasonable limits on the time span and aggregation interval parameters within incoming queries. By constructing a request with a very large time range and a minimal aggregation interval, an attacker can force the DataNode to attempt to build an enormous result set in memory. This exhausts the Java heap space, resulting in an OutOfMemoryError and a crash of the DataNode process. The issue is fixed in version 2.0.8.

## Affected products

- Apache IoTDB 1.3.3 to 2.0.7

## Identifiers

- CVE-2026-24012
- PYSEC-2026-2079

## Timeline

- 2026-07-06: advisory
- 2026-07-06: disclosed
- 2026-07-06: patched: Fixed in version 2.0.8

## References

- [https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8](https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8)

## Related threats

- [Apache IoTDB authorization bypass in fastLastQuery REST endpoint](https://junglewise.ai/threats/cve-2026-40452-apache-iotdb-authorization-bypass-in-fastlastquery-rest-endpoint)
- [Apache IoTDB privilege escalation via account renaming](https://junglewise.ai/threats/cve-2026-40009-apache-iotdb-privilege-escalation-via-account-renaming)
- [Apache IoTDB unsafe reflection in pipe processor](https://junglewise.ai/threats/cve-2026-40008-apache-iotdb-unsafe-reflection-in-pipe-processor)
- [Apache IoTDB uncontrolled recursion in AirGap receiver](https://junglewise.ai/threats/cve-2026-40007-apache-iotdb-uncontrolled-recursion-in-airgap-receiver)
- [Apache IoTDB resource exhaustion in AirGap pipe receiver](https://junglewise.ai/threats/cve-2026-40006-apache-iotdb-resource-exhaustion-in-airgap-pipe-receiver)