# CVE-2026-40006: Apache IoTDB resource exhaustion in AirGap pipe receiver

Source: https://junglewise.ai/threats/cve-2026-40006-apache-iotdb-resource-exhaustion-in-airgap-pipe-receiver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-40006 · Severity: info · Published 2026-07-10

Apache IoTDB, a database designed for managing large amounts of time-series data, contains a security flaw in its AirGap pipe receiver component. An unauthenticated attacker can send a specially crafted network request that forces the system to allocate massive amounts of memory. This can lead to a complete system crash or severe performance degradation, disrupting data operations and availability.

Technologies: [Apache Software Foundation IoTDB](https://junglewise.ai/threats/technologies/iotdb). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-40006 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40006 being exploited in the wild.

**How severe is CVE-2026-40006?** Informational severity, published 10 July 2026.

**Which products and versions are affected?** Apache Software Foundation IoTDB 1.0.0 to 2.0.9.

**Is there a fix for CVE-2026-40006?** A patch was published on 2026-07-10: Fixed in version 2.0.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40006 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40006?** Check whether you run Apache Software Foundation IoTDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Apache IoTDB contains a resource exhaustion vulnerability (CWE-770/CWE-789) combined with missing authentication (CWE-306) in the AirGap pipe receiver. When 'pipe_air_gap_receiver_enabled' is set to true, the component listens on TCP port 9780 without requiring authentication. The 'readLength' method reads a 32-bit integer directly from the socket and passes it to 'readData', which attempts to allocate a byte array of that size without any upper-bound validation. An attacker can specify a size up to ~2GB per connection, leading to heap exhaustion and a crash of the JVM DataNode process. The issue is fixed in version 2.0.10.

## Affected products

- Apache IoTDB 1.0.0 to 2.0.9

## Timeline

- 2026-07-10: disclosed
- 2026-07-10: advisory
- 2026-07-10: patched: Fixed in version 2.0.10

## References

- [https://lists.apache.org/thread/rfpt7m9fvdrw37r3ow5omp2n914z6zqk](https://lists.apache.org/thread/rfpt7m9fvdrw37r3ow5omp2n914z6zqk)

## Related threats

- [Apache IoTDB authorization bypass in fastLastQuery REST endpoint](https://junglewise.ai/threats/cve-2026-40452-apache-iotdb-authorization-bypass-in-fastlastquery-rest-endpoint)
- [Apache IoTDB privilege escalation via account renaming](https://junglewise.ai/threats/cve-2026-40009-apache-iotdb-privilege-escalation-via-account-renaming)
- [Apache IoTDB unsafe reflection in pipe processor](https://junglewise.ai/threats/cve-2026-40008-apache-iotdb-unsafe-reflection-in-pipe-processor)
- [Apache IoTDB uncontrolled recursion in AirGap receiver](https://junglewise.ai/threats/cve-2026-40007-apache-iotdb-uncontrolled-recursion-in-airgap-receiver)
- [Apache IoTDB path traversal in unsafe API](https://junglewise.ai/threats/cve-2026-40005-apache-iotdb-path-traversal-in-unsafe-api)