Apache IoTDB up to 2.0.9 AirGap Receiver readLength pipe_air_gap_receiver_enabled recursion

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Apache IoTDB up to 2.0.9. The affected element is the function readLength of the component AirGap Receiver. Performing a manipulation of the argument pipe_air_gap_receiver_enabled results in recursion. This vulnerability is reported as CVE-2026-40007. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Apache IoTDB up to 2.0.9. This affects the function readLength of the component AirGap Receiver. The manipulation of the argument pipe_air_gap_receiver_enabled with an unknown input leads to a recursion vulnerability. CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. This is going to have an impact on availability. The summary by CVE is:

Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticated attacker can send a stream of repeated E-language prefixes that drives the recursion arbitrarily deep, exhausting the receiver thread's JVM stack and raising StackOverflowError. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

It is possible to read the advisory at lists.apache.org. This vulnerability is uniquely identified as CVE-2026-40007 since 04/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/10/2026). The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 2.0.10 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Apache

Name

• IoTDB

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion