# CVE-2026-40007: Apache IoTDB uncontrolled recursion in AirGap receiver

Source: https://junglewise.ai/threats/cve-2026-40007-apache-iotdb-uncontrolled-recursion-in-airgap-receiver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-40007 · Severity: info · Published 2026-07-10

Apache IoTDB, a database designed for managing large volumes of time-series data from industrial devices, is vulnerable to a denial-of-service attack. An attacker can send specially crafted data to the system's AirGap receiver, causing the software to crash by exhausting its memory resources. This could lead to service outages and prevent the database from processing or storing incoming sensor data.

Technologies: [Apache Software Foundation IoTDB](https://junglewise.ai/threats/technologies/iotdb). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-40007 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40007 being exploited in the wild.

**How severe is CVE-2026-40007?** Informational severity, published 10 July 2026.

**Which products and versions are affected?** Apache Software Foundation IoTDB 1.0.0 to 2.0.9.

**Is there a fix for CVE-2026-40007?** A patch was published on 2026-07-10: Version 2.0.10 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40007 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40007?** Check whether you run Apache Software Foundation IoTDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Apache IoTDB AirGap receiver's readLength method due to uncontrolled recursion (CWE-674). When the 'pipe_air_gap_receiver_enabled' configuration is set to true, the readLength method recursively calls itself upon encountering an E-language prefix in socket data without a defined depth limit. An unauthenticated remote attacker can exploit this by sending a malicious stream of repeated prefixes, exhausting the JVM stack and triggering a StackOverflowError. This results in a denial-of-service for the affected receiver thread. The issue is fixed in version 2.0.10.

## Affected products

- Apache IoTDB 1.0.0 to 2.0.9

## Timeline

- 2026-07-10: advisory: NVD publication date
- 2026-07-10: disclosed: Apache Software Foundation mailing list disclosure
- 2026-07-10: patched: Version 2.0.10 released to address the issue

## References

- [https://lists.apache.org/thread/tr23kh6kp8drrsv8ypv1mqm4v5kyy23m](https://lists.apache.org/thread/tr23kh6kp8drrsv8ypv1mqm4v5kyy23m)

## Related threats

- [Apache IoTDB authorization bypass in fastLastQuery REST endpoint](https://junglewise.ai/threats/cve-2026-40452-apache-iotdb-authorization-bypass-in-fastlastquery-rest-endpoint)
- [Apache IoTDB privilege escalation via account renaming](https://junglewise.ai/threats/cve-2026-40009-apache-iotdb-privilege-escalation-via-account-renaming)
- [Apache IoTDB unsafe reflection in pipe processor](https://junglewise.ai/threats/cve-2026-40008-apache-iotdb-unsafe-reflection-in-pipe-processor)
- [Apache IoTDB resource exhaustion in AirGap pipe receiver](https://junglewise.ai/threats/cve-2026-40006-apache-iotdb-resource-exhaustion-in-airgap-pipe-receiver)
- [Apache IoTDB path traversal in unsafe API](https://junglewise.ai/threats/cve-2026-40005-apache-iotdb-path-traversal-in-unsafe-api)