Executive brief
Apache IoTDB, a database designed for managing large amounts of time-series data, contains a security flaw in its AirGap pipe receiver component. An unauthenticated attacker can send a specially crafted network request that forces the system to allocate massive amounts of memory. This can lead to a complete system crash or severe performance degradation, disrupting data operations and availability.
Technical details
Apache IoTDB contains a resource exhaustion vulnerability (CWE-770/CWE-789) combined with missing authentication (CWE-306) in the AirGap pipe receiver. When 'pipe_air_gap_receiver_enabled' is set to true, the component listens on TCP port 9780 without requiring authentication. The 'readLength' method reads a 32-bit integer directly from the socket and passes it to 'readData', which attempts to allocate a byte array of that size without any upper-bound validation. An attacker can specify a size up to ~2GB per connection, leading to heap exhaustion and a crash of the JVM DataNode process. The issue is fixed in version 2.0.10.
Affected products
- Apache IoTDB 1.0.0 to 2.0.9
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
- 2026-07-10: patched: Fixed in version 2.0.10