Executive brief
Apache IoTDB, a database designed for managing large volumes of time-series data from industrial devices, is vulnerable to a denial-of-service attack. An attacker can send specially crafted data to the system's AirGap receiver, causing the software to crash by exhausting its memory resources. This could lead to service outages and prevent the database from processing or storing incoming sensor data.
Technical details
A vulnerability exists in the Apache IoTDB AirGap receiver's readLength method due to uncontrolled recursion (CWE-674). When the 'pipe_air_gap_receiver_enabled' configuration is set to true, the readLength method recursively calls itself upon encountering an E-language prefix in socket data without a defined depth limit. An unauthenticated remote attacker can exploit this by sending a malicious stream of repeated prefixes, exhausting the JVM stack and triggering a StackOverflowError. This results in a denial-of-service for the affected receiver thread. The issue is fixed in version 2.0.10.
Affected products
- Apache IoTDB 1.0.0 to 2.0.9
Timeline
- 2026-07-10: advisory: NVD publication date
- 2026-07-10: disclosed: Apache Software Foundation mailing list disclosure
- 2026-07-10: patched: Version 2.0.10 released to address the issue