Executive brief
Apache IoTDB is a time-series database platform that handles sensor and telemetry data collection via an RPC service. A remote attacker without authentication can send a specially crafted network message that triggers excessive memory allocation, causing the service to crash and become unavailable to legitimate users.
Technical details
The vulnerability exists in improper validation of length fields in Thrift RPC frames processed by the Apache IoTDB RPC service. An attacker can craft a malformed Thrift frame with unchecked or oversized string length fields, causing the server to attempt allocating excessive memory, resulting in an OutOfMemoryError and service crash. The attack is unauthenticated and network-reachable, requiring only the ability to send crafted network packets. No user interaction or authentication is required. The issue affects versions before 1.3.8 and 2.0.0 through 2.0.9, with patches available in version 2.0.10 and later.
Affected products
- Apache IoTDB before 1.3.8, 2.0.0 before 2.0.10
Timeline
- 2026-08-10: disclosed: CVE-2026-44630 disclosed
- 2026-08-10: patched: Version 2.0.10 available; 1.3.8+ fixes the issue