Apache IoTDB up to 2.0.7 Query Processor resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Apache IoTDB up to 2.0.7. Impacted is an unknown function of the component Query Processor. This manipulation causes resource consumption. This vulnerability is tracked as CVE-2026-24012. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in Apache IoTDB up to 2.0.7 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Query Processor. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.  Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.

It is possible to read the advisory at lists.apache.org. This vulnerability is known as CVE-2026-24012 since 01/20/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/06/2026). The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 2.0.8 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• IoTDB

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion